secondfi.io
Summary
SecondFi is EMURGO's Cardano self-custody wallet and neofinance platform (rebranded from Yoroi in April 2026), not an on-chain DeFi protocol with smart contract TVL. A June 2026 deterministic nonce flaw in proprietary web wallet signing software let attackers reconstruct private keys from public blockchain data, draining ~16M ADA (~$2.4M) from 374 addresses; independent estimates put total exposure above $20M. The platform remains in maintenance mode with no published security audit reports despite years of marketing claims. Overall risk is elevated (5.9/10), driven by dependency, audit, and governance gaps rather than smart contract exposure.
Trust Assumptions
Users must trust that EMURGO's wallet signing code generates cryptographically secure, unpredictable nonces; that EMURGO-operated backends (zero.yoroiwallet.com) serve accurate chain data; and that third-party integrations (DexHunter, Steelswap, Wirex card rails) behave honestly. Following the June 2026 incident, users of affected addresses must also trust EMURGO's undisclosed third-party custodian holding ~129M ADA in emergency rescue funds, the unnamed post-incident security auditor, and EMURGO leadership (CEO Phillip Pon) to manage claims and platform restoration without on-chain enforceability.
What Could Go Wrong
Affected wallet addresses remain permanently compromised at the key level—restoring a seed phrase to another wallet does not fix the flaw—so any remaining or future funds sent to those addresses can be drained. EMURGO could resume operations before independent audit findings are published, leaving unverified signing code in production. The undisclosed emergency custodian holding ~129M ADA rescue funds creates counterparty risk if custodian identity, controls, or claim governance fail, and centralized EMURGO backend or DEX aggregator compromise could mislead users into signing malicious transactions even after a patch.
Recommendation
Do not deposit new funds into SecondFi or any address previously used with its web wallet until a named auditor publishes a full post-mortem and verified fix for the nonce/key-generation path. Treat all addresses that signed transactions via the SecondFi web wallet as permanently burned; migrate only to freshly generated keys on a different wallet. Monitor for publication of the post-incident security review, custodian identity disclosure, and compensation timeline before reassessing. The absence of public audits, bug bounty, and on-chain governance makes this unsuitable for material capital allocation until transparency and independent verification improve.
Key Findings (30)
Analysis Sections
SecondFi is not a DeFi protocol with on-chain contract governance. It is a corporate EMURGO-operated Cardano wallet/neofinance platform with no discoverable smart contracts, multisigs, or timelocks to audit. Product control rests with EMURGO leadership (CEO Phillip Pon), not a DAO. Marketing emphasizes self-custody, but the June 2026 incident demonstrated centralized emergency powers: maintenance-mode shutdown and unilateral movement of ~129M ADA to an undisclosed third-party custodian. Cardano DRep participation (Yoroi brand) is separate Cardano network governance and does not govern SecondFi product decisions. On-chain EVM verification was not possible (no contracts; ALCHEMY_RPC_URL unset).
Findings (7)
Marketing claims users 'hold the keys' and retain full control. During the June 2026 wallet-generation exploit, EMURGO/SecondFi engineering teams unilaterally placed the platform in maintenance mode (pausing all front-end transactions) and executed emergency rescue measures that moved ~129M ADA to an independent third-party custodian. Custodian identity, multisig structure, and user recourse mechanisms are not publicly disclosed. This contradicts pure self-custody assumptions and shows EMURGO retains operational authority over user fund flows in crisis scenarios.
SecondFi is operated by EMURGO, the for-profit Cardano co-founding entity. Discovery classifies governanceType as 'corporate (EMURGO subsidiary)'. Product decisions, incident response, and platform availability are controlled by EMURGO leadership—not by on-chain voting, a DAO, or user governance. Cardano founder Charles Hoskinson publicly confirmed IOG has no ownership, control, or business relationship with SecondFi, isolating accountability to EMURGO alone.
No protocol smart contracts, Gnosis Safe multisigs, timelocks, or on-chain governance contracts were identified. Wallet software updates are distributed via app stores and browser extension channels under EMURGO control. There is no community vote, proposal queue, or enforced delay on product changes. Open-source code exists at github.com/Emurgo/yoroi (Apache 2.0), but release authority and signing keys remain centralized.
Incident communications are led by EMURGO CEO Phillip Pon. Platform restoration, audit engagement, and custodian arrangements are decided internally by EMURGO without disclosed governance committees, board oversight structures, or public vote mechanisms. Wirex partnership (Visa debit card issuer) adds a second centralized dependency for payment features. No Immunefi bug bounty or public governance forum was identified for SecondFi-specific product decisions.
EMURGO/Yoroi operates a registered Cardano DRep (drep1ytvlwvyjmzfyn56n0zz4f6lj94wxhmsl5zky6knnzrf4jygpyahug) enabling users to delegate ADA voting power for Cardano protocol governance actions. After the SecondFi rebrand, the Yoroi brand continues independently as a DRep. This is Cardano ledger governance participation—not governance over SecondFi wallet software, custodian decisions, or platform policy. Users cannot vote on SecondFi feature changes, incident response, or custodian selection via DRep delegation.
Following the exploit, ~129M ADA was routed to an unnamed 'independent, qualified third-party custodian.' An external accounting firm was engaged to verify holdings, but custodian identity, governance structure (multisig threshold, signers), withdrawal policy, and user claim process governance are not publicly documented as of the analysis date. Users must trust EMURGO's custodian selection and verification process without independent on-chain enforceability.
Discovery returned an empty contracts array and the contracts/ directory is absent. Standard DeFi governance checks (owner(), admin(), multisig threshold, timelock delay) cannot be performed. ALCHEMY_RPC_URL is not set; even if available, SecondFi operates on Cardano with off-chain wallet infrastructure rather than EVM protocol contracts.