INCIDENT EVIDENCE GRAPH

SecondFi - Rekt

2026-06-23T00:00:00Z

A single missing secret in SecondFi's signing code made every on-chain transaction a private key disclosure. Attackers drained $2.4 million from 374 wallets on Cardano. One line of missing code, nothing more. Just reading what was already there.

• Victim: SecondFi, 374 Cardano wallets
• Exploit: Missing secret validation in signing code
• Method: Private key disclosure via missing signing code check

Primary evidence

1. SecondFi - Rekt
2. SecondFi hacked — $2.40M lost

中文