June 24, 2026 • 20 mins
Peter breaks down the latest SecondFi incident updates, why the issue was not a Cardano protocol hack, what affected users should avoid doing, how the white-hat recovery appears to have protected most funds, and why hardware wallets matter.
Key Takeaways:
- SecondFi says the security risk is at the address level and affected users should not restore their recovery phrase into another Cardano wallet.
- The incident appears tied to vulnerable wallet key generation rather than a Cardano protocol-level hack.
- SecondFi reported that external threat actors drained about 16 million ADA, while emergency white-hat measures secured about 129 million ADA for affected wallets.
- Users should rely on official SecondFi support updates and be alert for scammers impersonating support during the recovery process.
- Peter explains why hardware wallets such as Keystone, Ledger, and Tangem reduce signing and seed-phrase exposure risks.
- The episode also covers positive ecosystem updates including the Leios Musashi Dojo testnet and RealFi progress.
Links & References:
Ignore the FUD
https://link.learncardano.io/5Urg79
Cardano Wasn't Hacked
https://link.learncardano.io/IvXvSd
SecondFi Providing Clarity
https://link.learncardano.io/0yU82m
Phil's comments
https://link.learncardano.io/xYHJ9T
Max Explains vulnerability
https://link.learncardano.io/aV0RHF
SecondFi Explains the Whitehat Situation
https://link.learncardano.io/253neT
Giovani and Paul distils their message
https://link.learncardano.io/LpEFlU
https://link.learncardano.io/0h3srN
ItsDave's hack visualisation
https://link.learncardano.io/4GSHsR
Seba confirms
https://link.learncardano.io/hcqwWY
Leios Musashi Dojo is Live
https://link.learncardano.io/waRG02
RealFi is coming
https://link.learncardano.io/dg75nS
Website: https://learncardano.io
X/Twitter: https://x.com/LearnCardano
Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice or security advice for your specific situation.
DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.
🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k
Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/
Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano
Key Takeaways:
- SecondFi says the security risk is at the address level and affected users should not restore their recovery phrase into another Cardano wallet.
- The incident appears tied to vulnerable wallet key generation rather than a Cardano protocol-level hack.
- SecondFi reported that external threat actors drained about 16 million ADA, while emergency white-hat measures secured about 129 million ADA for affected wallets.
- Users should rely on official SecondFi support updates and be alert for scammers impersonating support during the recovery process.
- Peter explains why hardware wallets such as Keystone, Ledger, and Tangem reduce signing and seed-phrase exposure risks.
- The episode also covers positive ecosystem updates including the Leios Musashi Dojo testnet and RealFi progress.
Links & References:
Ignore the FUD
https://link.learncardano.io/5Urg79
Cardano Wasn't Hacked
https://link.learncardano.io/IvXvSd
SecondFi Providing Clarity
https://link.learncardano.io/0yU82m
Phil's comments
https://link.learncardano.io/xYHJ9T
Max Explains vulnerability
https://link.learncardano.io/aV0RHF
SecondFi Explains the Whitehat Situation
https://link.learncardano.io/253neT
Giovani and Paul distils their message
https://link.learncardano.io/LpEFlU
https://link.learncardano.io/0h3srN
ItsDave's hack visualisation
https://link.learncardano.io/4GSHsR
Seba confirms
https://link.learncardano.io/hcqwWY
Leios Musashi Dojo is Live
https://link.learncardano.io/waRG02
RealFi is coming
https://link.learncardano.io/dg75nS
Website: https://learncardano.io
X/Twitter: https://x.com/LearnCardano
Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice or security advice for your specific situation.
DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.
🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k
Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/
Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
All right, guys, we've got some updates around this second
five situation, and if you were affected by this, I
might have some really good news for you. Now we've
had some updates from the team and from various community
members that are focused on working on this situation to
make things right. So let me pull up the posts here.
But first off, there is a lot of fud going around.
(00:23):
There's a lot of scams, people trying to jump in
pretending they're second five support, So please be aware of this.
The fud and some of the social engineering around this
might actually trigger the outflows of your assets from your wallet.
So this is something to be aware of. Just sit
(00:44):
tight and most cases you should be. Okay, let me
go through the detail details here so you get an
idea of what's been going on. So, first off, Kadana
wasn't attacked or hacked directly, so this issue isn't with
Kadana and not the protocol itself, rather the third party wallet,
So we just want to make sure that is clear.
(01:05):
Second five is the issue here, and it's a very
specific issue with how the wallets the seed phrases were
generated on that particular app. And this is also including
if you imported your seed phrase in to the app,
and we'll find out more about that post mortem of
how that particular Candana address exploit was embedded into the app,
(01:27):
but we'll find out very soon. So this is coming
from this second five account itself, and this is the
account that you should be following on X so you
get up to date information about what to do next.
So to provide more clarity, we have identified the nature
of the insidant. It is an address level. It is
at the address level the security risk affected wallets users
(01:50):
when a transaction is signed. Therefore, recovery to another platform
or wallet does not mitigate this risk. Do not restore
your recovery phrase into a new Cadano wallet. We've isolated
the affected wallets and will post a mitigation steps shortly. Okay,
so that's where we're at the moment. There was a
(02:10):
lot of advice going around telling people to create a
brand new wallet, restore this seed phrase in a brand
new wallet, create a brand new wallet, and then just
transfer those assets over as quickly as possible. Some people,
from what I've heard, have done that and they have
their new seed phrase and their assets in that brand
new wallet, and they're pretty much okay, from what I understand,
(02:34):
if you're using a hardware wallet like a not eternal,
a Ledger or a Keystone or a Tangent wallet, you
should be totally fine as well, because you need that
hardware device to sign your transactions, to move anything out,
So the hacker couldn't possibly get that because it's a
physical device that you hold. So those people those type situations,
(02:57):
you should be totally fine as well. Now Here Pheil
clarified this. So Phil is probably one of the best
developers in the Cadna ecosystem, if not the best. He
jumps on things and thinks differently, so he's definitely a
person to listen to when it comes to things like this.
He also mitigated the mint swap situation in the early
(03:20):
days of Cadunda. DeFi so definitely someone to listen to
for this type of thing. So absolutely, do not migrate
your seed phrase out of second five to another wallet.
Do not sign any transactions at do not import those
else's phrases. I think he's meant seed phrases. He's probably
typing with no sleep here. Don't import those seed phrases anywhere.
(03:42):
If you follow any of the above advice, funds will
be safe. If you don't, you're putting your funds at
extreme risk. Okay, So my advice and what other people
say about restoring your seed phrases elsewhere could still have
some issues. But I did ask about this to get
some clarification, and some other people did ask if they
(04:02):
had already moved their assets out, if they'll be okay,
and most of them said it was pretty much okay.
So a little bit of mixed messaging here, but at
the moment, if you pretty much do nothing, you should
be okay. All right, So this is the theory around
what is actually happening here, and Max, another brilliant developing
the Kdana space, put out this and let me read
(04:25):
through this. What probably happening right now is that it's
not an attack hack anymore. It's a harvest. The attacker
pre derived the entire vulnerable key set during key generation
from a week RG predictable entropy collapse from keyspace from
blah blah blah bah. So basically what you're saying there
(04:46):
is like the key that was used to generate all
the seed phrases was reduced to something that was really
easy to hack brute force attack. It and it's supposed
to be two to the power of to fifty six,
which makes it really really hard, but in this case,
(05:06):
they dumped it down to something really easy, like you know,
ABCD or something like that, and it made them a
computational power for hacking those type of ce phrases really
really easy. So that's what's happening here. So now now
they're just watching the chain, sweeping every address that the
moment it moves, so essentially they're looking at particular addresses
(05:28):
and they say, oh, this one's active, let's go attack
that one. They've got some assets there and we can
brute force that one and then move the assets off.
So that's essentially what they're doing. But the problem here
also on Kadano addresses, only a hash of your public key.
The actual v key is revealed on chain only when
(05:50):
you spend send in a transaction witness, so it's a
bit of extra information that's put on chain when you
actually move assets through the Kadana ecosystem, and that's what
the attacker needed. They needed to see that vekey within
the transaction, So they're watching you move things to be
able to get the vekey and do the transaction and
(06:13):
steal it from you. So signing is the moment you
hand the attack of the confirmation mapping seed under the address,
and even your rescue transactions can get front run in
the men pool. Now what he means by that is
when you submit a transaction to Kadana, it goes to
a memory pool that sits on top of the various
(06:35):
state poles before the blocks get minted. So it sits
in that men pol and someone could send in a
transaction before you get that transaction out quicker than you can,
to steal your transaction essentially and then funnel it somewhere else.
So this is potentially what the hacker is doing. We
still don't know the details here, but this could very
(06:55):
well be what they're doing. So this is extremely sophisticated
and is done by someone that knows Kadano very well
for sure. Okay, so I've got some more here. So
this is the latest update from second five and this
is where the good news comes in. Kind of good news.
It's a it's a bit mixed here, but this is
(07:16):
going to be really interesting to see what comes out
of this. So we have identified the root cause and
have since rolled out a patch for all unaffected wallets.
This will allow us to resume normal operations soon. Now,
this is where it gets interesting. Regarding affected wallets, four
distinct draining events occurred. Three were executed by external threat actors,
(07:38):
resulting in a loss of sixteen million eight across three
hundred and seventy four addresses. Now, when we saw and
were watching the ADA being ripped out of the ecosystem,
we saw about one hundred and thirty million eight And
I was watching this and saw, you know, a Second
five post up sixty million eight? Is that all? But
I'm watching one hundred and thirty million eight to disappear.
(08:00):
This is where it goes into those details. To prevent
loss total loss during the active exploit, emergency rescue measures
were triggered to secure it. That available one hundred and
twenty nine million eight It and continues to be routed
to an independent, qualified, third party custodian where they are
held securely for the benefit of affected wallets. So what
(08:25):
does that mean. It means Second five moved out all
of your funds to a third party custodian to look
after it so the hacker couldn't get it. External cunning
firm has been engaged for a special audit to independently
verify these holdings. We're working to facilitate the verification process
so users can claim back their assets safely. Affected users
(08:48):
should submit through support dot secondfile, dot io. Oh my god,
this is going to be so messy. So if you
had your assets, if you had Second five were looking
at your wallet, you didn't transact at all, You're probably
fine because the hacker couldn't see the v key and
(09:10):
your transaction appear on chain, so they weren't watching they
they couldn't see it. They didn't know those details and
couldn't transact. Move your assets out. But Second five used
that same vulnerability and exploit to move everything off their
connected ecosystem and into a custodial wallet, and now they're
(09:32):
looking at returning everything back to you guys in some
way of form. So my god, this is messy. But
at least a majority of you guys out there will
get your assets back. I think that's the best out
of this particular situation. There's going to be still three
(09:54):
hundred and seventy four addresses that were completely affected by
the themselves, and sixty million eight are essentially lost. But
maybe that's that's the type of value that a mogo
could cover out of pocket and get back to you, guys.
So this could very well be a hack event on
(10:15):
the Cadina ecosystem, not Condynah itself, within the ecosystem where
everyone's funds can be returned and covered. All right, let's
have a look at what else they wrote here. We
take this incident seriously and we're working to ensure all
assets are returned to affected users as soon as possible.
As said, we have identified the root cause. It is
(10:38):
at the address level. Please do not restore your recovery
phrase into another Cardina wallet. This does not misget the
security risk. The security risk occurs when an affected user
signs a transaction. Further explanations to follow. All right, guys,
So this is definitely a developing story, so please keep
(11:00):
an eye on Second five. Turn on the notifications there
so you get a notification as soon as an update happens,
but essentially, sit tight, don't do anything. Your funds be
returned according to the Second five team here. Now, the
outcome from this lots of brand damage. Lots and lots
of brand damage here. Anyway, I've got some more follow
(11:24):
up posts here, so Giovanna here clarifies this. If I
read correctly, Amerga used the exploit to derive wallets and
anticipate the attacker. This way, only sixty million eights were
stolen by the real attackers, but Amergo borrowed and affected
users from affected users so they could eventually return them.
This is an interpretation of the message, but Giovanni, I
(11:47):
think you're completely right there now. Paul here also clarifies
the update Big update for affected users for distinct draining events.
Three malicious totaling sixteen million, one white hat hacker, second
five to secure one hundred and twenty nine million of
users funds. And it's Dave here did some really cool
(12:08):
visualizations of all of this, and I'd just like to
play this video here so you can see exactly what's
going on. So he mapped it out and tracked the
wallets and what was happening here. So we've got this
second five Custodia wallet, we've got some seed funding that
came in from finance, the second file wallet. You can
(12:30):
see the blue bar there that one is the hacker's wallet,
and you can see how much aider went there. But
look at that visualization of that purple blob, which is
everyone else that has Second five being sucked over to
the Second five wallet there. Sorry, this isn't the hackers wallet.
This is a consolidation wallet where the AIDA was moved to.
(12:52):
So the green one here is Second Fire's wallet where
they have all of the NFTs, the Kadano Native tokens,
and the blue ones is the consolidated one for just
eight or itself. I don't know why they had to
split it like that, but fair enough. If they've got
a plan here to manage all this, great, Maybe the
(13:14):
blue wallet is the custodial's wallet and that's just how
they needed to manage things. But anyway, that's all White Hack.
That's the good guys. That's if you see all those
it's because the good guys are holding onto it. It's
been about roughly twenty four hours since I watched all
of that those assets move, but my god, it was
(13:35):
a heart stopping moment for sure when I saw all
those assets move out. All right, So we've got a
lot of posts here about it. I'll put as many
as I can in the show notes down below. There's
one more here from Sebastian that talks about this very
good news for everybody affected. Majority of funds were a
(13:57):
white hack, so they can be returned through official sport tickets.
Careful of scammers, so be careful of beware of scammers.
Look at my profile pick. I warn you guys every
single day. Now, the main things that we can take
away from this is hardware wallets. Everyone should get a
hardware wallet. I've seen major amounts of assets here from
(14:21):
the original hacked and affected users, and I just wonder
why they were in hardware wallets. Let me just pull
some up for you guys, so you can have some references.
So the first one here is of course the keystone.
This is probably my wallet of choice at the moment.
It's a air gaped hardware wallets, so it's I've got
(14:41):
it here somewhere here. This is my hardware wallet here.
This is a nice Dino Press branded one. But this
thing here is air gapped. You don't plug it into
your computer, so that mitigates another risk where you have
a man in the middle. You have like a cable
that can Wi Fi transmit your seed phrase out from it.
This is completely air gap. You never plug into a computer.
(15:03):
You can charge it via a battery of some sort
and you can use that to scan a QR code
on your phone which will sign transactions, and it's a
brilliant way of doing it. The user experience is easy,
you can use other device. The other one I love
actually using is the Ledger. I've had this since twenty seventeen,
(15:24):
and it's a little bit clunkier in the Cadana ecosystem
because you have to sign and press so many buttons
to sign transaction. That still is a brilliant wallet. There
are some issues with the Ledger recovery side of things,
where they split your seed phrase off to three different
third parties so you can recover from it. That was
(15:44):
a forced opt in, but you know, it's still a
great hardware device. The last one I'll mention is the Tangum.
Tangeum is a really easy crypto wallet where they have
a physical device in this case is their ring, so
you can get a ring on your finger and use
that to sign your transactions within their mobile wallet. So
(16:08):
that's a brilliant one as well. And if you don't
like the ring, you can just get a normal card,
like a plastic card that's got a special chip in
there that you can scan with your phone. With the
NFG NFC chip within your phone and sign the transactions
that way. So these are three absolutely brilliant hardware wallets
and I highly recommend anyone with a substantial amount of
(16:30):
crypto assets to get one of these hardware wallets. So
definitely a learning lesson for everyone here. Hardware wallets are
definitely the way to go. Anyone that had a hardware
wallet that was connected to second five, they were not
affected at all, So something to take from all of
this learn from so it never will happen to you
(16:50):
in the future. In other news, we do have some
positive news. The LAOS on test net has been launched.
The Massa Massi Dojo has been open for testing, and
this is the test net network or LAOS whereas STATEPOARLD
(17:10):
operators can fire up a LAOS node and then we
can start transacting on the network and see exactly how
fast transactions are. So we're for statepold operators. If you
are a statepoarld operator, you can jump on and start
playing around with it. If you're a builder again you
can jump on and start playing around with as well,
and we can actually see exactly how fast LAOS is
(17:33):
and then see if we can break it as well,
so that's what they're looking for at the moment. They
want to see how fast they can push the LAOS
test net and see what issues, what bugs may come
about from it. So that is some really good news
there too. Some other cool news, Real Fi is pushing
their DeFi real World Asset DeFi with their USDR stable coin.
(17:55):
They are also approaching test net as well, and they're
ramping things up for statepool operators. So if you're a
single state pool operator out there between five and I
think it was fifteen million delegation on your pool, they're
looking for state pool operators to join their network at
the moment, and I believe they'll probably be doing an
ISPO or something along those lines where they're distributing tokens
(18:18):
through a statepool network. So they'll be trying to get
that statepool network, get people delegated to those particular pools,
and then reward them in some sort of way. So
that's what I think they're doing at the moment. We'll
wait and see what comes about from that. We'll get
more details. But these guys here at Real Fire are
(18:40):
actually delivering what Kadano's mission was supposed to be from
day one in twenty twenty one, where we're banking the unbanked,
we're finally delivering that message. We're looking at real world
finance through real world assets, backing finance loans and then
(19:01):
allowing for real yields through USDR. So that's what we're
looking at the moment, and it's really cool to see
this coming to fuition and I can't wait for this
one as well. So some good news overall, some bad
news with the second five hack obviously, but some really
good news in that there is a way out of
this and that massive amount of funds that were taken
(19:25):
out of the ecosystem were all done by our white
hat hacker. So overall, really good. We've got that, we've
got layoffs, and we have it real FI coming really soon. Guys. Overall,
I don't know what to think these days. I keep
on telling you guys to stay positive, so please try
and stay positive. There there are there is a white
(19:45):
lining on all of this overall in the end. But guys,
if you enjoyed this podcast episode, please make sure you
hit that thumbs up that like subscribe notification bell on
your way out. YouTube memberships down below, Buy me a
coffee link there if you want to support me that way,
really appreciated. Have people been using super thanks as well.
(20:06):
I never really pushed super Thanks through YouTube, but you
can do that as well. I actually have no idea
how to do it myself, but I'm sure if some
others can work it out, you can as well. And
like always, guys, stay positive and I'll see in the
next video.
All right, guys, we've got some updates around this second
five situation, and if you were affected by this, I
might have some really good news for you. Now we've
had some updates from the team and from various community
members that are focused on working on this situation to
make things right. So let me pull up the posts here.
But first off, there is a lot of fud going around.
(00:23):
There's a lot of scams, people trying to jump in
pretending they're second five support, So please be aware of this.
The fud and some of the social engineering around this
might actually trigger the outflows of your assets from your wallet.
So this is something to be aware of. Just sit
(00:44):
tight and most cases you should be. Okay, let me
go through the detail details here so you get an
idea of what's been going on. So, first off, Kadana
wasn't attacked or hacked directly, so this issue isn't with
Kadana and not the protocol itself, rather the third party wallet,
So we just want to make sure that is clear.
(01:05):
Second five is the issue here, and it's a very
specific issue with how the wallets the seed phrases were
generated on that particular app. And this is also including
if you imported your seed phrase in to the app,
and we'll find out more about that post mortem of
how that particular Candana address exploit was embedded into the app,
(01:27):
but we'll find out very soon. So this is coming
from this second five account itself, and this is the
account that you should be following on X so you
get up to date information about what to do next.
So to provide more clarity, we have identified the nature
of the insidant. It is an address level. It is
at the address level the security risk affected wallets users
(01:50):
when a transaction is signed. Therefore, recovery to another platform
or wallet does not mitigate this risk. Do not restore
your recovery phrase into a new Cadano wallet. We've isolated
the affected wallets and will post a mitigation steps shortly. Okay,
so that's where we're at the moment. There was a
(02:10):
lot of advice going around telling people to create a
brand new wallet, restore this seed phrase in a brand
new wallet, create a brand new wallet, and then just
transfer those assets over as quickly as possible. Some people,
from what I've heard, have done that and they have
their new seed phrase and their assets in that brand
new wallet, and they're pretty much okay, from what I understand,
(02:34):
if you're using a hardware wallet like a not eternal,
a Ledger or a Keystone or a Tangent wallet, you
should be totally fine as well, because you need that
hardware device to sign your transactions, to move anything out,
So the hacker couldn't possibly get that because it's a
physical device that you hold. So those people those type situations,
(02:57):
you should be totally fine as well. Now Here Pheil
clarified this. So Phil is probably one of the best
developers in the Cadna ecosystem, if not the best. He
jumps on things and thinks differently, so he's definitely a
person to listen to when it comes to things like this.
He also mitigated the mint swap situation in the early
(03:20):
days of Cadunda. DeFi so definitely someone to listen to
for this type of thing. So absolutely, do not migrate
your seed phrase out of second five to another wallet.
Do not sign any transactions at do not import those
else's phrases. I think he's meant seed phrases. He's probably
typing with no sleep here. Don't import those seed phrases anywhere.
(03:42):
If you follow any of the above advice, funds will
be safe. If you don't, you're putting your funds at
extreme risk. Okay, So my advice and what other people
say about restoring your seed phrases elsewhere could still have
some issues. But I did ask about this to get
some clarification, and some other people did ask if they
(04:02):
had already moved their assets out, if they'll be okay,
and most of them said it was pretty much okay.
So a little bit of mixed messaging here, but at
the moment, if you pretty much do nothing, you should
be okay. All right, So this is the theory around
what is actually happening here, and Max, another brilliant developing
the Kdana space, put out this and let me read
(04:25):
through this. What probably happening right now is that it's
not an attack hack anymore. It's a harvest. The attacker
pre derived the entire vulnerable key set during key generation
from a week RG predictable entropy collapse from keyspace from
blah blah blah bah. So basically what you're saying there
(04:46):
is like the key that was used to generate all
the seed phrases was reduced to something that was really
easy to hack brute force attack. It and it's supposed
to be two to the power of to fifty six,
which makes it really really hard, but in this case,
(05:06):
they dumped it down to something really easy, like you know,
ABCD or something like that, and it made them a
computational power for hacking those type of ce phrases really
really easy. So that's what's happening here. So now now
they're just watching the chain, sweeping every address that the
moment it moves, so essentially they're looking at particular addresses
(05:28):
and they say, oh, this one's active, let's go attack
that one. They've got some assets there and we can
brute force that one and then move the assets off.
So that's essentially what they're doing. But the problem here
also on Kadano addresses, only a hash of your public key.
The actual v key is revealed on chain only when
(05:50):
you spend send in a transaction witness, so it's a
bit of extra information that's put on chain when you
actually move assets through the Kadana ecosystem, and that's what
the attacker needed. They needed to see that vekey within
the transaction, So they're watching you move things to be
able to get the vekey and do the transaction and
(06:13):
steal it from you. So signing is the moment you
hand the attack of the confirmation mapping seed under the address,
and even your rescue transactions can get front run in
the men pool. Now what he means by that is
when you submit a transaction to Kadana, it goes to
a memory pool that sits on top of the various
(06:35):
state poles before the blocks get minted. So it sits
in that men pol and someone could send in a
transaction before you get that transaction out quicker than you can,
to steal your transaction essentially and then funnel it somewhere else.
So this is potentially what the hacker is doing. We
still don't know the details here, but this could very
(06:55):
well be what they're doing. So this is extremely sophisticated
and is done by someone that knows Kadano very well
for sure. Okay, so I've got some more here. So
this is the latest update from second five and this
is where the good news comes in. Kind of good news.
It's a it's a bit mixed here, but this is
(07:16):
going to be really interesting to see what comes out
of this. So we have identified the root cause and
have since rolled out a patch for all unaffected wallets.
This will allow us to resume normal operations soon. Now,
this is where it gets interesting. Regarding affected wallets, four
distinct draining events occurred. Three were executed by external threat actors,
(07:38):
resulting in a loss of sixteen million eight across three
hundred and seventy four addresses. Now, when we saw and
were watching the ADA being ripped out of the ecosystem,
we saw about one hundred and thirty million eight And
I was watching this and saw, you know, a Second
five post up sixty million eight? Is that all? But
I'm watching one hundred and thirty million eight to disappear.
(08:00):
This is where it goes into those details. To prevent
loss total loss during the active exploit, emergency rescue measures
were triggered to secure it. That available one hundred and
twenty nine million eight It and continues to be routed
to an independent, qualified, third party custodian where they are
held securely for the benefit of affected wallets. So what
(08:25):
does that mean. It means Second five moved out all
of your funds to a third party custodian to look
after it so the hacker couldn't get it. External cunning
firm has been engaged for a special audit to independently
verify these holdings. We're working to facilitate the verification process
so users can claim back their assets safely. Affected users
(08:48):
should submit through support dot secondfile, dot io. Oh my god,
this is going to be so messy. So if you
had your assets, if you had Second five were looking
at your wallet, you didn't transact at all, You're probably
fine because the hacker couldn't see the v key and
(09:10):
your transaction appear on chain, so they weren't watching they
they couldn't see it. They didn't know those details and
couldn't transact. Move your assets out. But Second five used
that same vulnerability and exploit to move everything off their
connected ecosystem and into a custodial wallet, and now they're
(09:32):
looking at returning everything back to you guys in some
way of form. So my god, this is messy. But
at least a majority of you guys out there will
get your assets back. I think that's the best out
of this particular situation. There's going to be still three
(09:54):
hundred and seventy four addresses that were completely affected by
the themselves, and sixty million eight are essentially lost. But
maybe that's that's the type of value that a mogo
could cover out of pocket and get back to you, guys.
So this could very well be a hack event on
(10:15):
the Cadina ecosystem, not Condynah itself, within the ecosystem where
everyone's funds can be returned and covered. All right, let's
have a look at what else they wrote here. We
take this incident seriously and we're working to ensure all
assets are returned to affected users as soon as possible.
As said, we have identified the root cause. It is
(10:38):
at the address level. Please do not restore your recovery
phrase into another Cardina wallet. This does not misget the
security risk. The security risk occurs when an affected user
signs a transaction. Further explanations to follow. All right, guys,
So this is definitely a developing story, so please keep
(11:00):
an eye on Second five. Turn on the notifications there
so you get a notification as soon as an update happens,
but essentially, sit tight, don't do anything. Your funds be
returned according to the Second five team here. Now, the
outcome from this lots of brand damage. Lots and lots
of brand damage here. Anyway, I've got some more follow
(11:24):
up posts here, so Giovanna here clarifies this. If I
read correctly, Amerga used the exploit to derive wallets and
anticipate the attacker. This way, only sixty million eights were
stolen by the real attackers, but Amergo borrowed and affected
users from affected users so they could eventually return them.
This is an interpretation of the message, but Giovanni, I
(11:47):
think you're completely right there now. Paul here also clarifies
the update Big update for affected users for distinct draining events.
Three malicious totaling sixteen million, one white hat hacker, second
five to secure one hundred and twenty nine million of
users funds. And it's Dave here did some really cool
(12:08):
visualizations of all of this, and I'd just like to
play this video here so you can see exactly what's
going on. So he mapped it out and tracked the
wallets and what was happening here. So we've got this
second five Custodia wallet, we've got some seed funding that
came in from finance, the second file wallet. You can
(12:30):
see the blue bar there that one is the hacker's wallet,
and you can see how much aider went there. But
look at that visualization of that purple blob, which is
everyone else that has Second five being sucked over to
the Second five wallet there. Sorry, this isn't the hackers wallet.
This is a consolidation wallet where the AIDA was moved to.
(12:52):
So the green one here is Second Fire's wallet where
they have all of the NFTs, the Kadano Native tokens,
and the blue ones is the consolidated one for just
eight or itself. I don't know why they had to
split it like that, but fair enough. If they've got
a plan here to manage all this, great, Maybe the
(13:14):
blue wallet is the custodial's wallet and that's just how
they needed to manage things. But anyway, that's all White Hack.
That's the good guys. That's if you see all those
it's because the good guys are holding onto it. It's
been about roughly twenty four hours since I watched all
of that those assets move, but my god, it was
(13:35):
a heart stopping moment for sure when I saw all
those assets move out. All right, So we've got a
lot of posts here about it. I'll put as many
as I can in the show notes down below. There's
one more here from Sebastian that talks about this very
good news for everybody affected. Majority of funds were a
(13:57):
white hack, so they can be returned through official sport tickets.
Careful of scammers, so be careful of beware of scammers.
Look at my profile pick. I warn you guys every
single day. Now, the main things that we can take
away from this is hardware wallets. Everyone should get a
hardware wallet. I've seen major amounts of assets here from
(14:21):
the original hacked and affected users, and I just wonder
why they were in hardware wallets. Let me just pull
some up for you guys, so you can have some references.
So the first one here is of course the keystone.
This is probably my wallet of choice at the moment.
It's a air gaped hardware wallets, so it's I've got
(14:41):
it here somewhere here. This is my hardware wallet here.
This is a nice Dino Press branded one. But this
thing here is air gapped. You don't plug it into
your computer, so that mitigates another risk where you have
a man in the middle. You have like a cable
that can Wi Fi transmit your seed phrase out from it.
This is completely air gap. You never plug into a computer.
(15:03):
You can charge it via a battery of some sort
and you can use that to scan a QR code
on your phone which will sign transactions, and it's a
brilliant way of doing it. The user experience is easy,
you can use other device. The other one I love
actually using is the Ledger. I've had this since twenty seventeen,
(15:24):
and it's a little bit clunkier in the Cadana ecosystem
because you have to sign and press so many buttons
to sign transaction. That still is a brilliant wallet. There
are some issues with the Ledger recovery side of things,
where they split your seed phrase off to three different
third parties so you can recover from it. That was
(15:44):
a forced opt in, but you know, it's still a
great hardware device. The last one I'll mention is the Tangum.
Tangeum is a really easy crypto wallet where they have
a physical device in this case is their ring, so
you can get a ring on your finger and use
that to sign your transactions within their mobile wallet. So
(16:08):
that's a brilliant one as well. And if you don't
like the ring, you can just get a normal card,
like a plastic card that's got a special chip in
there that you can scan with your phone. With the
NFG NFC chip within your phone and sign the transactions
that way. So these are three absolutely brilliant hardware wallets
and I highly recommend anyone with a substantial amount of
(16:30):
crypto assets to get one of these hardware wallets. So
definitely a learning lesson for everyone here. Hardware wallets are
definitely the way to go. Anyone that had a hardware
wallet that was connected to second five, they were not
affected at all, So something to take from all of
this learn from so it never will happen to you
(16:50):
in the future. In other news, we do have some
positive news. The LAOS on test net has been launched.
The Massa Massi Dojo has been open for testing, and
this is the test net network or LAOS whereas STATEPOARLD
(17:10):
operators can fire up a LAOS node and then we
can start transacting on the network and see exactly how
fast transactions are. So we're for statepold operators. If you
are a statepoarld operator, you can jump on and start
playing around with it. If you're a builder again you
can jump on and start playing around with as well,
and we can actually see exactly how fast LAOS is
(17:33):
and then see if we can break it as well,
so that's what they're looking for at the moment. They
want to see how fast they can push the LAOS
test net and see what issues, what bugs may come
about from it. So that is some really good news
there too. Some other cool news, Real Fi is pushing
their DeFi real World Asset DeFi with their USDR stable coin.
(17:55):
They are also approaching test net as well, and they're
ramping things up for statepool operators. So if you're a
single state pool operator out there between five and I
think it was fifteen million delegation on your pool, they're
looking for state pool operators to join their network at
the moment, and I believe they'll probably be doing an
ISPO or something along those lines where they're distributing tokens
(18:18):
through a statepool network. So they'll be trying to get
that statepool network, get people delegated to those particular pools,
and then reward them in some sort of way. So
that's what I think they're doing at the moment. We'll
wait and see what comes about from that. We'll get
more details. But these guys here at Real Fire are
(18:40):
actually delivering what Kadano's mission was supposed to be from
day one in twenty twenty one, where we're banking the unbanked,
we're finally delivering that message. We're looking at real world
finance through real world assets, backing finance loans and then
(19:01):
allowing for real yields through USDR. So that's what we're
looking at the moment, and it's really cool to see
this coming to fuition and I can't wait for this
one as well. So some good news overall, some bad
news with the second five hack obviously, but some really
good news in that there is a way out of
this and that massive amount of funds that were taken
(19:25):
out of the ecosystem were all done by our white
hat hacker. So overall, really good. We've got that, we've
got layoffs, and we have it real FI coming really soon. Guys. Overall,
I don't know what to think these days. I keep
on telling you guys to stay positive, so please try
and stay positive. There there are there is a white
(19:45):
lining on all of this overall in the end. But guys,
if you enjoyed this podcast episode, please make sure you
hit that thumbs up that like subscribe notification bell on
your way out. YouTube memberships down below, Buy me a
coffee link there if you want to support me that way,
really appreciated. Have people been using super thanks as well.
(20:06):
I never really pushed super Thanks through YouTube, but you
can do that as well. I actually have no idea
how to do it myself, but I'm sure if some
others can work it out, you can as well. And
like always, guys, stay positive and I'll see in the
next video.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by Audiochuck Media Company.
The Clay Travis and Buck Sexton Show
The Clay Travis and Buck Sexton Show. Clay Travis and Buck Sexton tackle the biggest stories in news, politics and current events with intelligence and humor. From the border crisis, to the madness of cancel culture and far-left missteps, Clay and Buck guide listeners through the latest headlines and hot topics with fun and entertaining conversations and opinions.