EMURGO, the Cardano-founding entity behind SecondFi, said Monday the hacked wallet service will not resume normal operations even after ongoing security audits conclude, telling all users to migrate away using its official recovery process.

“Although we believe unaffected users remain safe, SecondFi will not resume normal operations, even after the audits are complete,” EMURGO said in a post on its official X account. Going forward, EMURGO said, its role in SecondFi is limited to “a dedicated asset recovery team, tasked solely with returning assets to affected users.”

The Underlying Breach

SecondFi, a rebrand of the Yoroi wallet, is what EMURGO has called “Cardano’s largest wallet provider.” The service was hit by four distinct wallet-draining events discovered June 22, compromising 374 addresses and roughly 16 million ADA, worth about $2.4 million at the time, according to EMURGO’s own June 25 incident report. The team said it separately secured about 129 million ADA through emergency containment.

EMURGO has said compromised wallets should be treated as permanently exposed at the address and private-key level, meaning restoring an affected seed phrase into another wallet will not fix the risk.

Recovery Plan

EMURGO said it has engaged multiple independent firms to review the incident and code, and has submitted a patch closing the identified vulnerability, though investigations continue. It plans to launch a quarantined wallet-status checker this week, pending app-store approval, followed by a secure export tool for migrating funds to a hardware wallet or alternative platform, and an in-person migration workshop in Tokyo.

A dedicated restoration fund is being built into an on-chain recovery system that EMURGO said still requires an external audit before affected users’ assets can be returned. EMURGO said it will publish a full account of who was responsible and why once incident reports and code reviews are finalized.