QooryBeta
Back to narratives
SecurityActive
Conversation intelligence

SecondFi/Yoroi Wallet Hack Sparks Governance Fallout on Cardano

SecondFi, the rebranded Yoroi wallet, suffered a critical vulnerability that exposed private keys during web wallet creation, leading to theft of ~16 million ADA ($2.4M) plus tokens and NFTs from 178 wallets. The incident also triggered a ~13% drop in Yoroi DRep voting power over 8 epochs as ~90 million ADA was withdrawn by stakers.

Heat
107
Confidence
92%
Evidence
6
Updated

Why It Happened

A flaw in SecondFi's web wallet creation allowed attackers to obtain private keys and drain self-custody wallets. The governance impact reflects users losing trust in the Yoroi DRep, which represents the largest voting power on Cardano.

Outcome So Far

SecondFi entered maintenance mode, took a balance snapshot, and plans to compensate users. Yoroi DRep voting power has fallen by ~13%. No arrests or fund recovery reported yet.

Actors

SecondFiSelf-custodial card. Spend anywhere Visa works.

SecondFi is a neofinance platform on Cardano that suffered an exploit draining $2.4 million from wallets due to a vulnerability in its wallet generation software.

YOYoroi Walletproject
CardanoPeer-reviewed blockchain for secure dApps

Cardano is a blockchain platform built on academic research that enables smart contracts and decentralized applications while using significantly less energy than traditional cryptocurrencies like Bitcoin. What sets Cardano apart is its methodical, research-driven approach — every major feature is peer-reviewed by scientists and cryptographers before being added to the network. This careful process aims to create a more secure and stable foundation compared to platforms that prioritize speed over thorough testing. The platform's native cryptocurrency, ADA, is used to send money, pay transaction fees, and participate in network governance. Cardano uses a proof-of-stake system to process transactions, which works differently from Bitcoin's mining approach. Instead of competing to solve complex puzzles, users can "stake" their ADA — essentially locking it up temporarily — to become validators who verify transactions. The system selects validators based on how much ADA they've staked and for how long, then rewards them with additional ADA for their participation. This approach uses far less energy than traditional mining while keeping the network secure. The platform also features a two-layer design that separates basic payment transactions from smart contract operations, allowing each function to be optimized independently for better performance. ADA holders can earn staking rewards by locking up their tokens to help secure the network, vote on proposed changes to the platform, and use ADA for international money transfers with lower fees than traditional services. Cardano was founded in 2017 by Charles Hoskinson, who previously helped create Ethereum. Hoskinson leads Input Output Global (IOG), the technology company that builds and maintains Cardano's core software. The ecosystem operates through three organizations: IOG handles technical development, the Cardano Foundation promotes adoption and standardization, and Emurgo helps businesses integrate blockchain t

ATAttackerattacker
Timeline order

Post
Parent event 01

SecondFi wallet enters maintenance mode

Paul CW reports that after reports of wallet drains, SecondFi has put its wallet into maintenance mode after identifying a security issue.

Related posts@cwpaulm
@cwpaulm
Open on X11.6K views · 81 likes · 9 reposts

Post
Parent event 02

SecondFi hack and wallet drain reported

Crypto Banter reports a critical flaw in SecondFi (rebranded Yoroi) exposed private keys during web wallet creation; ~178 wallets drained of ~16M ADA plus tokens and NFTs. SecondFi enters maintenance mode, takes snapshot, and plans compensation.

Related posts@crypto_banter
@crypto_banter
Open on X20.0K views · 54 likes · 9 reposts

Post
Parent event 03

X conversation update

1 related posts from @C__Herridge

Related posts@C__Herridge
@C__Herridge
Open on X175.0K views · 5.1K likes · 2.2K reposts

Post
Parent event 04

Community criticises Yoroi for remaining DRep after hack

Rodrigo Pacini criticises Yoroi for not stepping down as DRep after the wallet vulnerability put users at risk, calling it a governance failure that should embarrass the Cardano ecosystem.

Related posts@RodrigoPacini
@RodrigoPacini
Open on X8.8K views · 175 likes · 25 reposts

Post
Parent event 05

X conversation update

1 related posts from @SlowMist_Team

Related posts@SlowMist_Team
@SlowMist_Team
Open on X12.7K views · 82 likes · 20 reposts

Post
Parent event 06

Yoroi DRep voting power drops after hack

Adatainment reports that the Yoroi Wallet DRep, one of the largest on Cardano, has seen its voting power drop ~13% over 8 epochs since the exploit, with ~90 million ADA withdrawn by stakers.

Related posts@adatainment
@adatainment
Open on X3.8K views · 70 likes · 7 reposts