SecondFi Lost 16.1M ADA Worth $2.6M to Lazarus Group and Second Attacker Between June 21-23

According to ChainCatcher, SecondFi reported that 374 wallets had approximately 16.1 million ADA (roughly $2.6 million) stolen between June 21 and June 23. The investigation identified two independent attackers: the primary attacker is suspected to be North Korea-linked hacking group Lazarus Group with sophisticated techniques and well-funded operations; a second attacker simultaneously targeted different wallets with no overlap between the two groups.

The root cause was a cryptographic vulnerability in the wallet's signature generation process, also found in unauthorized code copies on GitHub. SecondFi has patched the flaw and decided to shut down both SecondFi and Yoroi wallets. The team is developing a zero-knowledge proof-based recovery tool expected in August and wallet export functionality to help users safely migrate assets.