CEO @SecondSwap_io, the Nasdaq Private Market for tokenized assets. Ex-OSL & dtcpay. Building for the long game.
Joined March 2022
- Tweets144
- Following155
- Followers287
- Likes266
Heres a detailed look at the incident from the perspective of a forensic firm that flags the attack vector and identifies links back to Lazarus group.
An update regarding the recent security incident involving SecondFi
What happened to SecondFi
Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets. We want to provide users with a transparent update based on the information currently available.
An independent investigation
EMURGO engaged Groom Lake, an independent forensic investigation / blockchain intelligence provider to assist with tracing and evidentiary analysis and they reviewed the incident using primary technical evidence, including code, code history, and public blockchain data.
What the investigation indicates to date:
1. Attack from an external actor: linked to high-volume addresses employing advanced tradecraft: @0xGroomLake indicates that the primary operation behind the unauthorised transfers was sophisticated, external, and well-funded, with indicators consistent with activity by a professional, state-aligned threat actor. Certain indicators are being assessed for potential overlap with known DPRK-linked threat activity of Lazarus Group.
2. Two separate attackers: Groom Lake also identified activity by a second party that appears, based on current evidence, to be separate from the primary operation and to have affected a different set of wallets during the same window. No overlap in affected wallets has been identified to date.
The root cause: A cryptographic flaw
The root cause was a highly subtle flaw in how the wallet software generated per-transaction signatures. In simplified terms, a value that should have been derived from secret information could, under certain conditions, be computed from public transaction data. This could enable affected private key material to be derived from information visible on the public blockchain.
This cryptographic flaw was also visible in a copy of the relevant code that had been published without authorisation to a public GitHub repository. We are continuing to assess the circumstances surrounding the publication and are cooperating with the relevant authorities.
Fix and winding down of SecondFi
The flaw has been patched, and new wallets created with the corrected software are not known to be affected by this issue. However, given the gravity of this event and as previously announced, we have made the difficult decision to wind down SecondFi and Yoroi wallet.
Asset recovery and safe migration
Our current priority is supporting affected users, assisting recovery efforts, and enabling users to move assets securely.
1. Recovery tool: A secure recovery tool using zero-knowledge (ZK) proofs is being developed. The portal is designed to allow users to initiate the process directly while limiting the information required to do so. The tool is currently in testing, and we are engaging a specialist third-party auditor to review it before its anticipated release in August 2026.
2. Safe migration: In the meantime, we are preparing wallet export functionality designed to allow users to migrate their assets to a wallet of their choice. We anticipate releasing this by early August 2026.
Please follow our official channels for further updates.
Important Security Reminder
SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first. Do not trust any checker, link, or account outside our official channels:
▪️ X accounts: @secondfiapp and @secondfi_jp
▪️ Support portal: support.secondfi.io
SecondFi will not resume normal operations, even once the audits are complete. Going forward, our involvement in @secondfiapp is limited to a dedicated asset recovery team, tasked solely with returning assets to affected users.
Kanny retweeted
As per our previous post:
teapawt.org/secondfiapp/status/206…
We have identified the root cause and have since rolled out a patch for all unaffected wallets. This will allow us to resume normal operations soon.
-----
Regarding affected wallets, 4 distinct draining events occurred. 3 were executed by external threat actors, resulting in a loss of ~16m ADA across 374 addresses.
To prevent total loss during the active exploit, emergency rescue measures were triggered to secure the available ~129m ADA and continues to be routed to an independent, qualified third-party custodian, where they are held securely for the benefit of the affected wallet addresses.
An external accounting firm has been engaged for a special audit to independently verify those holdings.
We are working to facilitate the verification process so users can claim back their assets safely. Affected users should submit their claim at support.secondfi.io
We take this incident seriously and are working to ensure all assets are returned to affected users as soon as possible.
As stated, we have identified the root cause, it is at the address level. Please DO NOT RESTORE your recovery phrase into another Cardano wallet, this does not mitigate the security risk. The security risk occurs when an affected user signs a transaction.
Further explanation to follow.
To provide more clarity, we have identified the nature of the incident, it is at the address level. The security risk affects wallet users when a transaction is signed.
Therefore recovery to another platform or wallet does not mitigate the risk.
🚨 DO NOT restore your recovery phrase into a new Cardano wallet.
We have isolated the affected wallets and will post mitigation steps shortly.
The future of everyday onchain finance is here. 🟦 So proud of the team behind @secondfiapp for launching today!
No permission, no unnecessary friction, and no one holding the keys but you. We’re combining DeFi, TradFi, and AI to give you one app to spend, trade, earn, and save. Your money stays yours.
Join the movement: teapawt.org/secondfiapp/status/206…
1.4 billion people are locked out of the financial system.
Today, that changes for good.
Your second home for money is here. 🟦 A self-custody neofinance platform where DeFi, TradFi, and AI power one app to spend, send, stake, swap, and save. Money that stays yours, the way it always should have been.
Stop settling for the system you inherited.
Start building the financial life you choose.
Download it now: secondfi.io
📖 | secondfi.io/secondfi-launche…
SecondSwap started with a clear access problem: locked token value should be easier to use and understand.
The standalone dApp begins its evolution today, but the work moves forward. The first planned rollout for the next phase will be under SecondFi.
Join the waitlist: secondfi.io
SecondSwap is evolving into SecondFi.
SecondSwap helped users access secondary markets for locked tokens. SecondFi carries that work forward in a broader self-custody neofinance platform built for spending, trading, earning, and saving.
Marketplace activity is paused for new transactions during the transition. If you have locked token allocations that have not yet been claimed, you can still claim them through the marketplace.
No migration is required on the user side. Read the transition post for more details.
Visit SecondFi to join the waitlist: secondfi.io and follow @secondfiapp for future updates.
At TEAMZ Summit, I shared a simple view on RWA: issuance is only the start. Liquidity is what scales the market.
At @SecondSwap_io, we are building the secondary market for tokenized assets on @avax together with Ocean Finance.
Thanks Blockmedia for the coverage.
blockmedia.co.kr/archives/10…
Kanny retweeted
BREAKING: SecondSwap crosses $5M in TVL, led by a recent $3M contribution from RWA projects on @avax.
📊 : dune.com/secondswapio/second…
Airport taxi sign listing every payment method imaginable.
Cards. Wallets. QR apps. Bank rails.
The industry solved payments by adding more payments.
The next phase will be consolidating them.
Web3 built primary markets first.
Now we need real secondary markets.
Over $400B in token value has unlocked in the past five years, yet most locked allocations still trade manually in opaque OTC chats. That is not market structure. That is patchwork.
On the Global Tokenization panel, I’m talking about why secondary liquidity is not optional. It is infrastructure. If we want healthier token ecosystems, we need transparent, on-chain rails that take capital from locked to liquid.
Great discussion with all star panel:
@bryansbodner of @OpenAssetsInc;
@KevinSusanto of Indonesia Blockchain Council;
Kelvin Tan of @dbsbank;
Andrea Gerali of @bancaditalia;
and moderated by Nathanael Lim of @Mishcon_de_Reya
Consensus Hong Kong felt different this year.
HK is as vibrant as ever. The city still moves fast, still feels like a real financial hub. But attendance was lighter than previous years. Fewer tourists. More operators.
The upside of that shift is the quality of conversation. Less pitching. More building.
AI and crypto came up in almost every serious discussion. Not as a buzzword pairing, but as a real design question. How do these systems actually intersect in products people use?
There was also a quiet confidence among builders. Bear markets forge will. When prices are down, you find out who is here to build something durable. The focus narrows. The distractions fall away.
One clear trend stood out: crypto companies are working harder to stay relevant in everyday life. You can see it in the number of card launches and payment integrations. Less theory. More “how does this get used on Tuesday afternoon?”
The energy wasn’t euphoric. It was deliberate.
And honestly, that feels healthier.
“RWA” only matters if it maps to real cash flows.
Global trade finance moves trillions every year. This partnership puts real trade flows on-chain, with verification built in.
Less narrative, more infrastructure.
theedgesingapore.com/news/bl…
Say hi if you spot our team rocking the SecondSwap tee 🙌
📍Reporting from @consensus_hk : The Wednesday Roundup
Here what we’ve been hearing on the ground from Day 1 of the Main Event and @solana Accelerate APAC.
💧RWAs Heating Up > Tokenization is gaining traction across real estate, gold and industrial assets. Hong Kong’s stablecoin and ETF framework are attracting serious players. Scalability and TradFi integration are key for RWA adoption and secondary liquidity rails are the bridge.
💧Buzz & Excitement > Despite the market mood, focus has shifted to stable yields and tokenized equities. Convo circled around BTC at ~50K? Solana infra continues to win. Privacy remains a hurdle, but clearer policy is boosting RWA conviction.
💧 Liquidity > No big reveals or announcement here but the structural need for onchain liquidity is obvious. RWAs with 5–10+ year horizons demand secondary markets. Side events tease unlocks via tokenized funds or OTCs, echoing our case for discounted and oversight driven trades.
Say hi if you spot us rocking the SecondSwap tee 👋
Kanny retweeted
📹 Happening Now
Our CEO @LCV_KL is in a media interview with the @MidnightNtwrk team🤝
Rational privacy has been front and center here at Consensus. We need this privacy layer more than ever especially as the next gen of finance, internet and AI takes shape.
Partnership announcement coming soon?
Kanny retweeted
📍Tuesday Roundup: Reporting from @consensus_hk
Yesterday was packed with conversations with new and existing connections.
💧We got a sneak peek of the main event. The prediction market space is packed with builders, and many leading consumer apps are already active there. Predict EVERYTHING.
💧We also noticed a clear shift in investor mood. The chase for outsized gains has cooled. Most are now satisfied with steady and predictable returns.
💧“Tokenizing the world” remains the mantra. We had electric conversations with teams tokenizing everything from money market funds and Australian real estate to more complex delta-neutral strategies.
Onward to another full day ahead.
Kanny retweeted
📍Reporting LIVE from @consensus_hk
Kicked off Monday morning at LTP Liquidity 2026.
💧Booths this year skewed towards on infra (think: data centers, fund services, custody)
💧After months of alts selloffs, appetite for secondary markets has cooled. Investors shifted attention towards equities and RWAs.
💧Allocators are back on the hunt. However, this time deploying less volatile strategies. Think deeper OTC discounts (>50% discounts for 1 month lock) and delta neutral them.
Attended the Green Finance and RWA Tokenization event organized by Upwood
💧Interesting take on tokenizing real forest assets and carbon credits.
💧Examples like IKEA's ~$720m forest acquisitions in the Baltics highlight how established this asset class already is at the institutional level. Returns come from timber harvesting, replanting cycles, carbon credit sales and long term appreciation in forest land value.
💧This mirrors other RWA cases where secondary liquidity matters. Forestry investments typically span more than 20 years. Without secondary markets, exits depend on asset sales or fund wind-downs.
More to come. Excited for the main event today.
Kanny retweeted
📍We're LIVE at @consensus_hk
Our team is on the ground today.
Say hi to @LCV_KL and our team to talk anything about locked tokens and RWA liquidity.
If you're a token issuer, primary issuer or RWA tokenization platform thinking about secondary liquidity - let's talk 💬
Dm us to set up a chat while we're here 🤝
