Charles Hoskinson: SecondFi App don Compromise, Cardano Protocol no Affect

Charles Hoskinson give new live update on June 24, 2026, after im review minified TypeScript from the SecondFi application and do independent forensic analysis of the wallet incident. The update focus on how the attack take happen, why the case dey point go SecondFi application code and why the evidence wey dey available no show say Cardano protocol fail, including core nodes, open source wallet libraries or foundational cryptography.

Cardano Protocol Security Separate From SecondFi Incident

Hoskinson review check whether the SecondFi incident dey limited to one application or e connect to wider issue for Cardano cryptographic supply chain. Im assessment no find any sign say the open source Cardano cryptographic libraries wey most wallets for the ecosystem dey use don compromise.

The technical review cover key derivation, signature construction, recovery word generation, HD wallet mechanics and UTXO selection. Dem describe those components as consistent with the open source infrastructure wey Cardano wallets dey use before the incident.

The anomalous transactions wey connect to SecondFi instead tie to the application closed source codebase, wey dem modify from open source standards. This distinction stand central to the update, Cardano network, nodes, protocol level cryptography and open source wallet infrastructure comot from the suspected failure inside one specific wallet application.

SecondFi Code and Wallet Audit Standards Enter Focus

The next stage of the case now depend on independent audit. Dem expect that process to explain how the incident take happen, who responsible and wetin be the remediation plan wey dem go offer to affected users.

Hoskinson avoid publish the specific technical path of the attack before further disclosure from Emurgo or the SecondFi team. Instead, the update put formal verification, audit discipline and application level accountability for center of the investigation.

The incident still reopen the broader question of wallet standards for the Cardano ecosystem. Lace and Daedalus come up as examples of wallet software wey dem develop around open source visibility and external review. The wider position wey the update present be say wallet code wey dey handle user funds suppose be open source, make dem audit am regularly and maintain am with shared scrutiny when cryptographic components fit affect the broader ecosystem.

The concern no be only say vulnerability exist. The deeper issue na modification of sensitive cryptographic code outside public review. For wallet builders, the SecondFi case now put application design, cryptographic implementation, audit history and open source transparency directly inside the security discussion.

User Safety, White Hat Claims and Remediation Plan

The update still address early claims say some funds fit don move by white hat actor instead of the attacker. That claim still need confirmation through the audit process or official remediation plan, so fund recovery and return procedures never resolve.

Hoskinson still address the question whether the 24 wallet recovery words don compromise. Based on the code wey im review, the recovery words themselves no look like say dem compromise for that stage. The update still note say this one hard to verify without full access to the complete key derivation process, especially where wallets fit don generate for Yoroi and later import into SecondFi, or dem generate directly inside SecondFi.

Until the audit and remediation process complete, make people treat the SecondFi application as compromised. The safest approach wey the update describe na to leave keys for rest and avoid to dey transact through any SecondFi wallet.

The update still clarify the limits of Input Output role. The company no get any special authority to freeze, reverse or recover funds for the protocol level. Cardano no include intervention mechanics of that kind, e align the network with global cryptocurrency model wey no single company or individual dey control user balances.

The investigation now depend on three concrete deliverables, independent audit, technical explanation from the teams wey dey responsible for SecondFi and user remediation plan. For the wider Cardano ecosystem, the live update narrow the case to application code, closed source wallet changes and audit accountability, while e keep the protocol layer, open source wallet libraries and core cryptographic infrastructure outside the reported failure.