Between June 21-23, 2026, deterministic nonce reuse in SecondFi's Cardano signing code (one missing line) exposed 374 wallet private keys through all historical signatures. Attacker drained 16.1M ADA (~$2.4M); white hat protected $18.5M ADA. Total exposure: $20M+.

SecondFi (formerly Yoroi) Cardano wallet suffered an exploit due to a vulnerability in its proprietary web wallet generation software, exposing private keys at the address level. Attackers drained ~16 million ADA ($2.4M) from 374 affected wallets across three attacks. The project secured ~129 million ADA (~$19.4M) through emergency rescue; affected users must wait for official recovery and are advised to use hardware wallets for migration.