Cardano wallet firm SecondFi finally launched a recovery portal for victims of the neo-finance platform’s $21 million hack, but will only pay roughly $8 for every unrecoverable NFT taken
SecondFi says victims looking to recover their assets will be assessed with an “incident snapshot” based on the June 2026 exploit of Cardano wallets
This snapshot will only act as an estimate, and SecondFi claims, “The final amount may differ.”
Unfortunately, for any NFTs that for some reason cannot be returned to victims, SecondFi says it will offer unlucky holders “a fixed amount” of 30 ADA, worth $7 and 60 cents
Victims are also required to use a newly created Cardano wallet for the destination of any recovered funds
Today’s portal launch was initially scheduled for August, but was pushed back several times across September
The portal allows victims to verify their affected wallets and submit a claim for any taken assets
Incredibly, the project’s official guide recommends typing the private recovery phrase of an exploited wallet into SecondFi’s webpage, an extremely dangerous suggestion that puts users at risk of spoofing, man-in-the-middle, and a variety of other catastrophic attack vectors
Their exploited wallet addresses are checked against the incident snapshot, where a tool provides “an estimated breakdown of any assets eligible for recovery.”
Victims must then provide a new Cardano wallet address as a destination for the recovered assets. A zero-knowledge proof is then created (this can take up to 15 minutes) before the recovery claims process begins (this can take up to five working days)
Criminal hackers stole $2.4 million from Cardano wallets thanks to a “nonce derivation” issue that exposed users’ private keys
Around the same time, a mysterious white hat hacker took $18.5 million from Cardano wallets as part of the platform’s security response
