SecondFi offers $8 per unrecoverable NFT in Cardano hack recovery portal
Cardano wallet firm SecondFi opens recovery portal for hack victims
SecondFi has launched a recovery portal for victims of its June 2026 Cardano wallet hack, which saw roughly $21 million in assets stolen. However, the company says it will only pay around $8 for NFTs that cannot be recovered.
The portal was originally scheduled for August but was pushed back several times through September. It allows victims to verify affected wallets and submit claims for stolen assets.
SecondFi stated that claimants will receive an "incident snapshot" showing an estimate of eligible assets. The company warned that "the final amount may differ" from this estimate.
What victims can expect from the recovery
For NFTs that cannot be returned, SecondFi said holders will receive a fixed payout of 30 ADA, worth approximately $7.60 based on current prices. Victims must also provide a newly created Cardano wallet address to receive any recovered funds.
The recovery process involves generating a zero-knowledge proof, which can take up to 15 minutes, followed by a claims review period of up to five working days.
Security concerns raised about recovery process
The Protos report notes that SecondFi's official guide recommends users type their private recovery phrase directly into the company's website. Private recovery phrases are secret words that give full control over a cryptocurrency wallet — entering them on any website is widely considered extremely dangerous and could expose users to spoofing and man-in-the-middle attacks.
Background on the Cardano wallet exploit
The June 2026 exploit involved a "nonce derivation" issue that exposed users' private keys on the Cardano blockchain. Criminal hackers stole $2.4 million from Cardano wallets through this vulnerability. Around the same time, a mysterious white hat hacker withdrew $18.5 million from Cardano wallets as part of what was described as a security response.
Following the hack, SecondFi announced it was winding down its operations to focus on asset recovery. Emurgo, the Cardano-focused organization behind SecondFi, also gave up its plans to run a TOKEN2049 event booth due to the incident.
What remains unclear
It is not yet clear how many NFT holders will qualify for the 30 ADA payout or how the final assessment will compare to the initial incident snapshot. The recommendation to enter private recovery phrases on the recovery portal website also raises concerns about user security that have not been addressed by the company.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.