SecondFi Offers 30 ADA Per Unrecoverable NFT After $21M Cardano (ADA) Hack

SecondFi Recovery Portal Opens

A flaw in the key-handling code of SecondFi's crypto wallets for Cardano (ADA) is what set this story in motion. In June 2026, a defect in how the wallets derived nonce values, the single-use numbers used in every transaction signature, left users' private keys exposed, and assets worth roughly $21 million left the neo-finance platform before the episode closed, a sum the project has treated as the incident's headline cost. How the defect reached production is not fully documented: SecondFi has published no complete post-mortem naming the exact code path. On-chain records from the incident show two separate movements: criminal hackers drained $2.4 million directly from affected wallets, while an unidentified white hat actor removed another $18.5 million in what the project described as part of its security response. Four months on, and after repeated delays the company announced through the summer, the recovery phase has begun. SecondFi launched its recovery portal on Wednesday, letting victims have their losses assessed against an “incident snapshot” of the June exploit. The portal lets users verify their affected wallets and submit a claim for any assets taken. The company cautions that the snapshot is only an estimate, stating, “The final amount may differ.” Where assets cannot be returned in their original form, the offer is a fixed 30 Cardano (ADA), worth $7.60 at the rate the project set, and that figure applies to every unrecoverable NFT, an asset class whose market values range from trivial to well above the payout. Claims also require a fresh destination: victims must provide a newly created wallet address to receive returned funds, keeping recovered assets away from the addresses the June exploit touched. The Cardano (ADA) price slipped 4.4% over the past 24 hours, a muted market response to a plan four months in the making.

August Deadline Slipped Across September

The portal's arrival was anything but punctual. SecondFi had originally scheduled the launch for August, a date the company pushed back several times across September before Wednesday's release. Victims waited through each pushback with no formal claim route in place. The claims process runs in defined steps, and each one adds waiting time. Victims verify their affected wallet addresses against the incident snapshot, after which a tool produces an estimated breakdown of the assets eligible for recovery. They must then supply a newly created wallet address as the destination for any returned funds. A zero-knowledge proof, a cryptographic method for validating a claim without revealing the data behind it, is generated next, a step that can take up to 15 minutes. The recovery claims process itself can take up to five working days, which pushes even smooth claims toward mid-October. One instruction in the project's official guide stands out: it recommends typing the private recovery phrase of an exploited wallet, the master seed that controls every address in an HD wallet, directly into SecondFi's webpage. The guidance leaves users open to spoofing and man-in-the-middle attacks if the page they load is not the genuine article, a risk that persists even with the portal live. The danger does not depend on SecondFi's own intentions; a lookalike domain is enough. The recovery effort is now the entire business of the altcoin wallet firm: SecondFi announced after the incident that it was winding down operations to focus on asset recovery. Its parent carries reputational costs too. Emurgo, the Cardano (ADA) co-founder and SecondFi's creator, gave up the handling of its Token2049 booth as a result of the hack, an episode related to the Token2049 booth dispute COINOTAG covered earlier this week.

Snapshot Estimates Meet NFT Market Values

The number to watch inside the portal is the fixed 30 ADA, about $7.60, applied to every unrecoverable NFT regardless of its market value. Holders of low-value collections gain a floor; owners of assets that traded well above that level absorb the shortfall, and the “final amount may differ” caveat leaves even the snapshot estimates without a guarantee. The phrase-entry recommendation is the residual operational risk: holders moving funds after an exposure should treat a cold wallet as the baseline, and our guide to staking ADA with Ledger covers one such path. Neither the attacker transaction hashes nor a complete post-mortem has been published, so the $2.4 million and $18.5 million split rests, for now, on the project's own account of the June records.