Cryptocurrency wallet SecondFi is shuttering after an attack drained $2.4 million from its users.
The company announced Wednesday (July 22) that it had addressed the vulnerability that permitted the theft of 16.1 million in ADA last month, and had secured another 129 million ADA before hackers could get to it.
“However, given the gravity of this event and as previously announced, we have made the difficult decision to wind down SecondFi and Yoroi wallet,” the company said.
The root cause of the incident was a “highly subtle flaw in how the wallet software generated per-transaction signatures,” SecondFi added.
“In simplified terms, a value that should have been derived from secret information could, under certain conditions, be computed from public transaction data,” the company said.
“This could enable affected private key material to be derived from information visible on the public blockchain”
Groom Lake, the intelligence firm commissioned by blockchain company EMURGO, learned that the main attacker was “external, and well-funded, with indicators consistent with activity by a professional, state-aligned threat actor,” the company said, adding there are some indications suggesting involvement by North Korea’s Lazarus Group.
SecondFi said it anticipates it will have wallet export tools ready early next month, with a zero-knowledge recovery portal rolling out later in August.
The attack on SecondFi is part of a series of recent exploits at digital asset platforms this year. But this theft was dwarfed by the April exploit of the Kelp DAO decentralized finance (DeFi) platform, which saw roughly $292 million stolen, leading to a chain reaction that erased nearly $9 billion from the largest DeFi lending platform.
As PYMNTS wrote soon after, the incident highlighted the “unavoidable tensions” between crypto’s desire for open, interoperable systems and the institutional demand for security and control, something that has historically defined and even impeded blockchain’s evolution.
“Does this delay the institutional adoption of DeFi? Maybe,” Ryan Rugg, global head of digital assets for Citi Treasury and Trade Solutions, said during a conversation for PYMNTS “From the Block” podcast. “It is going to take some of the confidence out of the market.”
However, Rugg stopped short of labeling the incident a defining setback, arguing that any institutionally driven decision will likely depend on whether companies can establish “proper redundancy and security at every layer where the trust resides.”