Cardano SecondFi Breach: 129M ADA Worth $18.5M Moved by White Hat

Cardano News

Cardano (ADA) is at the center of an $18.5 million wallet breach after a self-described white hat hacker moved 129 million ADA out of vulnerable SecondFi wallets. The disclosure, made on June 25 by Cardano founder Charles Hoskinson during an X Spaces session, revealed that the identity of the actor remains unknown to Emurgo, the firm that built the platform. Hoskinson relayed secondhand that an Emurgo team member said the white hat is not affiliated with the company. The exploit did not break the Cardano protocol; the flaw sat entirely at the wallet application layer, yet the reputational hit to the ecosystem is tangible and the market is pricing it accordingly.

On-chain data shows large holders leaned into the weakness rather than away from it. Wallets holding between 10 million and 100 million ADA lifted their share of circulating supply from 37.66% on June 25 to 38.13% as the month closed, a steady accumulation even as the altcoin traded near multi-year lows. Outputs above 1 million ADA spiked on June 21 and again on June 24, when the count of distinct large wallets hit a 45-day high. Such flows can include exchange and internal transfers, so they signal positioning more than confirmed buying, but the directional tilt toward accumulation is clear in the figures.

The accumulation contrasts sharply with a cooling network. Daily transactions on Cardano fell to roughly 17,400 on June 28, near the lowest level in 45 days, while smart contract transactions dropped to about 4,250 that day, down from around 26,000 at recent peaks. The divergence leaves a clear split between large-holder conviction and broader user engagement, which has thinned during a period of heavy protocol upgrade work. For a network whose long-term thesis rests on developer and application activity, the slump in on-chain usage is a caution flag that sits uneasily against the whale-driven supply concentration.

The 129 million ADA at the center of the dispute was framed by SecondFi as an emergency rescue operation, routed to what it called an independent, qualified third-party custodian holding the funds for affected addresses. Cybersecurity researchers estimated total exposure could exceed $20 million. SecondFi, one of the largest Cardano wallet generators and formerly known as Yoroi Wallet, took a final balance snapshot on June 26 and said it will return lost assets within two weeks, while cautioning that the timeline is not guaranteed. It urged users not to move funds to new wallets, warning that independent actions taken outside official guidance create additional risk.

Beyond the contested rescue, three separate external attackers drained approximately 16 million ADA, worth about $2.4 million, from 374 addresses across four distinct draining events. The root cause was a critical flaw in SecondFi’s key-generation software, the component responsible for producing the cryptographic keys that secure user funds. Because the weakness lived in how keys were created rather than in Cardano’s base layer, every party from the Intersect governance body to Hoskinson has stressed the protocol itself stayed intact. The episode is a reminder that application-layer security, including how wallets handle signing, remains a soft spot even when an underlying chain is sound.

ADA changed hands near $0.145 on June 29, down about 21% over two weeks and roughly 38% across 30 days, leaving the token close to multi-year lows and around 95% below its all-time high. The coin ranks 21st by market value at about $5.4 billion. Technically, price sits well below its 50-day exponential moving average at $0.1904 and its 100-day EMA at $0.2248, a configuration that keeps the broader bear market structure intact. Until those moving averages flip from resistance to support, rallies are likely to be sold, and the burden of proof rests with buyers to reclaim lost ground.

COINOTAG’s proprietary 42-indicator composite scoring engine rates the $0.1413 support at 80/100, the strongest level on our board, anchored by the confluence of the Keltner lower band and the prior-day low; secondary support at $0.1347 scores 73/100 off the ATR lower band and a recent swing low. Overhead, the $0.1465 resistance carries a 62/100 score from the prior-day high and R1 pivot. Derivatives read cautiously constructive: funding sits barely positive at 0.0026%, open interest is $143.7 million, and the long/short account ratio of 2.20 shows 68.7% of accounts positioned long. With RSI at 29 and the Fear & Greed Index at 12 (Extreme Fear), a daily close below $0.1413 would invalidate the bullish base case and open the $0.1347 zone.