SecondFi, the Cardano wallet platform formerly known as Yoroi, is warning users about a coordinated phishing campaign targeting victims of a recent security breach. The platform disclosed that cybercriminals are sending fraudulent recovery emails designed to trick users into signing malicious transactions or revealing wallet credentials. This secondary attack wave highlights a troubling pattern in crypto security: the period immediately following a major hack often becomes the most dangerous time for victims.

What Exactly Is Happening With SecondFi's Phishing Campaign?

The fake recovery emails are carefully crafted to impersonate official SecondFi support communications. According to the company, scammers claim that user wallets have entered a "Quarantine Mode" following the recent security incident and that victims must immediately sign a so-called Service Agreement to regain access to their assets. The emails create artificial urgency by warning that funds could be permanently lost if users fail to complete the requested steps within a limited timeframe.

SecondFi has explicitly confirmed that these claims are entirely false. The company has never introduced any recovery process requiring users to sign blockchain transactions through unsolicited emails, nor do its official wallet verification tools require transaction approvals simply to check whether a wallet has been affected. The fraudulent messages are designed to manipulate users into voluntarily authorizing transactions that could transfer control of their wallets to attackers.

What makes this attack particularly dangerous is that blockchain transactions cannot be reversed after approval, unlike traditional password theft. Once a user signs a malicious transaction, attackers may gain permission to transfer digital assets or assume broader control of the entire wallet.

How Large Is the Original SecondFi Security Breach?

The underlying security incident that triggered these phishing campaigns stems from a wallet-generation vulnerability within SecondFi's platform. SecondFi initially estimated customer losses at approximately 16 million ADA (the native token of the Cardano blockchain). However, blockchain security researchers have suggested the financial impact could be substantially larger.

Blockchain security firm SlowMist conducted on-chain analysis and traced transactions linked to wallets allegedly controlled by the attackers. According to SlowMist's findings, more than 129 million ADA, along with additional digital assets, may have moved through addresses connected to the exploit. This massive discrepancy between SecondFi's initial estimate and independent blockchain analysis has raised serious questions about the full scale of the incident. An independent audit is currently underway to establish a more complete picture of total losses.

Cardano founder Charles Hoskinson publicly acknowledged the breach, noting that while some cryptocurrency hacks involving billions of dollars naturally dominate headlines, the impact of smaller incidents should not be underestimated. For individual users, losing an entire wallet balance can be financially devastating regardless of the total amount stolen across the platform.

How to Protect Yourself From SecondFi Phishing Scams

• Never Sign Unsolicited Transactions: SecondFi emphasizes that legitimate recovery processes will never require users to sign blockchain transactions through unsolicited emails. Any request to approve wallet transactions via email should be treated as a red flag.
• Verify Through Official Channels Only: The only legitimate course of action currently available is submitting an official support ticket through SecondFi's authorized communication channels. Always independently verify the legitimacy of incoming messages before taking any action.
• Ignore Requests for Sensitive Information: Legitimate companies will never request wallet recovery phrases, private keys, or wallet credentials by email. Be extremely cautious of any message asking for this information, regardless of how professionally designed it appears.
• Avoid Clicking Suspicious Links: Phishing emails often direct users to counterfeit websites designed to imitate official platforms. Do not click any links contained in suspicious emails, and instead navigate directly to the official SecondFi website by typing the URL into your browser.
• Check Email Sender Addresses Carefully: Scammers often use email addresses that closely resemble official company addresses. Examine the full email address, not just the display name, to verify legitimacy.

Security professionals describe this type of attack as a classic social engineering campaign. Rather than exploiting software vulnerabilities directly, criminals exploit fear and urgency. Victims receive an email appearing to come from the company's support team, claiming immediate action is necessary because of the recent security incident. Recipients are instructed to click a recovery link that opens a counterfeit website designed to imitate SecondFi's official platform. Users are then asked to connect their wallet and approve one or more blockchain transactions under the pretense of verifying ownership or restoring access.

Why Do Phishing Attacks Spike After Major Hacks?

Security experts have long warned that the period immediately following a cryptocurrency hack is often when phishing attacks become most aggressive. Victims searching for updates or hoping to recover lost assets are frequently targeted with fake support messages that imitate official communications. This pattern has become predictable across the crypto industry.

Over the past several years, similar scams have appeared following security incidents involving exchanges, decentralized finance (DeFi) protocols, non-fungible token (NFT) marketplaces, and blockchain wallets. In many cases, phishing attacks ultimately steal more funds than the original exploit because users unknowingly authorize malicious transactions themselves. The emotional pressure following a hack often causes victims to act quickly without verifying the legitimacy of incoming messages.

The SecondFi incident is part of a broader trend affecting the digital asset industry throughout 2026. Cybersecurity researchers have documented a noticeable increase in attacks targeting wallet infrastructure, private keys, and blockchain applications. Several major incidents this year have highlighted how attackers are increasingly shifting their focus away from smart contract exploits toward infrastructure vulnerabilities, including wallet-generation weaknesses, cross-chain bridge exploits, private key compromises, and social engineering attacks.

At the time of writing, SecondFi has not announced a timetable for potential reimbursement or compensation for affected users. The company is urging every user to remain vigilant and verify any communication through official channels before taking any action.