ADA Wallet Shutdown: SecondFi Implements Recovery Plan Following Lazarus Group Breach

• SecondFi permanently shuts down its Cardano wallet service following a June 2026 security breach that resulted in the theft of 16.1 million ADA.
• The Lazarus Group exploited an Android vulnerability to compromise 374 accounts, prompting a structured three-stage recovery roadmap .
• A zero-knowledge proof compensation system is being developed to allow users to verify ownership and claim refunds securely .
• The recovery plan involves automated migration tools and claims portals, with the final refund stage scheduled for early September .
• Affected users are advised to avoid uninstalling the app until the migration phase concludes to prevent data loss .

SecondFi has announced the permanent shutdown of its Cardano wallet service, shifting all remaining resources toward recovering stolen assets and compensating affected users . This decision follows a significant security breach in June 2026, where attackers exploited a vulnerability in the Android version of the wallet to derive private keys from 374 compromised accounts . The Lazarus Group was linked to the attack, resulting in the theft of 16.1 million ADA, valued at approximately $2.5 million .

In response to the breach, the development team secured 129 million ADA by moving unaffected assets into custodial storage . The recovery effort is supported by Input Output Group and the Cardano Foundation, who are developing a zero-knowledge proof compensation system . This technology allows users to verify ownership of compromised wallets without exposing seed phrases or private keys, enhancing security during the recovery process .

What Is the Recovery Timeline for Affected ADA Holders?

The recovery roadmap consists of three distinct stages . The first stage, already launched, features an updated application with a simplified claims system for affected users . This initial phase focuses on identifying victims and initiating the verification process through the new interface .

The second stage, scheduled for mid-August, introduces an automated migration tool that unstakes ADA and transfers coins, tokens, and NFTs to user-selected Cardano wallets . Developers caution against uninstalling the app before migration to avoid complications, as the tool requires active access to process the transfers . This phase is critical for restoring liquidity and utility to the remaining assets held within the compromised ecosystem .

The final stage, arriving in early September, will introduce a zero-knowledge proof refund portal after independent cryptographic audits . This portal will enable the distribution of compensation to users who have verified their ownership through the previous stages . The timeline reflects a deliberate approach to ensure the security and integrity of the compensation mechanism before funds are released .

How Does the Zero-Knowledge Proof System Ensure Security?

The integration of zero-knowledge proof technology represents a significant technical advancement in asset recovery . By allowing users to prove ownership without revealing sensitive cryptographic data, the system mitigates the risk of further key exposure . This approach addresses the core vulnerability that led to the initial breach, where private keys were derived from compromised devices .

Input Output Group and the Cardano Foundation are collaborating to implement this system, leveraging their expertise in Cardano's cryptographic standards . The independent audits preceding the refund portal launch are designed to validate the robustness of the verification protocol . This collaborative effort aims to restore trust in the Cardano ecosystem by demonstrating a transparent and secure method for handling large-scale security incidents .

What Precautions Should Users Take During the Recovery Process?

Throughout this process, SecondFi has warned users about phishing attempts and advised verifying all links through official channels . The complexity of the recovery process, involving multiple stages and external verification, makes users vulnerable to social engineering attacks . Users are urged to remain vigilant and avoid sharing any personal information or seed phrases with third parties .

The transition to custodial storage for unaffected assets and the use of automated migration tools require careful attention to detail . Users must ensure they select legitimate Cardano wallets for the migration phase to prevent assets from being sent to invalid addresses . Adhering to official communication channels and avoiding unofficial updates is essential for maintaining security during the recovery period .