Cardano With Paul Examines SecondFi Recovery Limits

Users affected by SecondFi’s June security incident can now check which assets are available for recovery and request delivery to a new Cardano wallet. The tool launched on October 7 as SecondFi winds down operations. In his walkthrough, Cardano With Paul explains how the process works and where it falls short of resolving users’ remaining exposure.

How SecondFi Recovery Works

SecondFi, formerly known as Yoroi, has separate tools for migration and recovery.

Migration moves assets still held in a wallet, while recovery addresses eligible assets affected by the incident. These include funds that white hat security specialists moved into safekeeping using the same vulnerability exploited by malicious attackers.

The recovery tool checks the affected wallet’s addresses, displays eligible assets, and generates a cryptographic proof linking the request to a new destination. SecondFi advises allowing up to five working days for processing.

The receiving address must belong to a newly created Cardano wallet controlled by the user, including a hardware wallet. Exchange deposit addresses are excluded.

Paul demonstrates the initial checks with a temporary test wallet because he has no affected wallet available. His video therefore covers the interface and published instructions without completing an actual payout. He also reports conflicting accounts of recovery outcomes, particularly for assets taken by malicious attackers rather than secured by white hats.

Recovery Phrases and Compensation Limits

The process requires the affected wallet’s recovery phrase to generate a zero-knowledge proof. SecondFi’s documentation describes local processing in the browser, with the proof submitted instead of the phrase. Paul questions the decision to require entry through a website and highlights the danger of imitation portals. Only the old wallet’s phrase is involved; the new destination requires its public receiving address.

That distinction does not amount to an independent security assessment. At the time of recording, Paul was unaware of publicly available source code for the tool and relied on SecondFi’s description of how it handles wallet credentials.

Recovery amounts also have limits. The displayed allocation is an estimate and may differ from the final return. Eligible NFTs secured for recovery may be returned directly; those that cannot be returned receive a fixed allocation of 30 ADA each, without an individual valuation. The destination address cannot be changed after submission, and the official process requires neither a recovery fee nor an advance transfer of funds.

Midnight Redemptions Remain Exposed

Users awaiting further NIGHT tokens through Glacier Drop face a separate problem. Allocations unlock in stages and are delivered to the Cardano address designated during the original claim process. Moving an existing wallet balance elsewhere does not redirect those later deliveries.z

Paul considers redeeming the tokens and immediately transferring them to another wallet, but describes a race against any attacker monitoring the compromised address. He also discusses paying redemption fees from another wallet, which would still leave the tokens arriving at the original destination. Neither approach removes the risk of an attacker taking them before the holder can act.

SecondFi’s guidance warns that future NIGHT redemptions sent to affected wallets may be drained and may not be recoverable. A successful recovery payment does not restore the security of those wallets or change the destination registered for Glacier Drop. Users may therefore receive eligible assets at their new address while subsequent Midnight distributions remain tied to the compromised one.