2026-06-24
Update
- A forensics follow up on the Second Fi incident, having disassembled its minified TypeScript and replicated how the attack occurred.
- The open source Cardano cryptographic libraries used by the majority of wallets are not compromised: key derivation, signatures, and HD wallets appear intact.
- The anomalous transactions are tied to Second Fi's closed, modified code, not the open source standards.
- The crypto media claiming Cardano was hacked is dismissed as AI slop, since the protocol, core crypto, and open source wallets are fine.
- The 24 seed words do not appear compromised, but until proven otherwise the Second Fi application should be treated as compromised, with keys left at rest.
- The lesson: wallet and cryptographic code should be open source, independently audited, and built by a federation rather than a sole vendor.
13 entries
After disassembling the minified TypeScript of Second Fi and doing independent forensics, he replicated how the attack occurred.
Checking whether the issue is contained to Second Fi or Cardano's crypto supply chain, the open source Cardano cryptographic libraries are not compromised.
Key derivation, signature construction, HD wallets, and UTXO selection on the open source wallets appear exactly as before.
The anomalous transactions are connected to Second Fi's closed source code, modified from the open source standards.
As with Lace and Daedalus, wallet code should always be open source and subject to regular independent audits.
Cryptographic code that concerns the whole ecosystem should never be built by a sole vendor, but by a federation that consumes and maintains it.
The crypto media claiming Cardano was hacked and all ada is compromised is AI slop, since the protocol, core crypto, and open wallets are fine.
There is no cryptographic issue and no contagion spreading, so anyone not using that specific company's code has fine funds.
If buggy software runs on Windows you do not say Microsoft was hacked, so blaming the Cardano protocol for one application is dishonest.
The 24 seed words do not appear compromised and could be used in a BIP style redemption, though what is derived after them is problematic.
Until proven otherwise, treat the Second Fi application as compromised, and the safest move is to leave keys at rest and not transact.
IO has no power to freeze or reverse funds by design, because Cardano is a real cryptocurrency like Bitcoin with no intervention mechanics.
The issue does not spread to wallets that follow best practices: open source, third party audited, and never modifying cryptographic code.