SecondFi Recovery: 100M ADA Returned After the Yoroi Hack

0:00 All right, guys, we've got some really good news around the second FI hack update. I was in Singapore when the recovery tool was released. So I didn't know that was going on. I saw glimpses of it and I thought that it was still coming. But people have started recovering their funds. This is really good news. This is a post on Reddit. Last week, I followed the recovery tool steps. Got confirmation that all the assets are stolen, submitted the details, blah, blah, blah. But four days later, they got everything back. I'm seeing more and more reports of this and a lot of happy users so thankful that their funds have been restored. So this is really good news. Now, it wasn't a lot of users. The impact here was quite small. So let me go through

0:45 the details here. So there were roughly 374 wallets that were drained back in June. of 16 million ADA. And this is the ADA that was linked directly to the hackers themselves. There was more ADA that was taken from users and that was through the white hat hackers process of looking at all the other compromised wallets and just taking all those funds out. So there are two buckets here.

1:09 There are two buckets. There's a white hat hacker and there's also the Lazarus group linked hackers, the 16 million. Now both of those buckets are being restored for people. So The Emergo company, the group, decided that the 16 million ADA, they were going to make people whole again and use their reserves, their ADA holdings to make those users whole again. Amazing. Absolutely amazing. There's still a lot of that ADA that is being held by the hacking group.

1:40 And I've looked at the wallets and they're just being monitored and they're just sitting there. So I don't know if they'll be able to move that ADA. Thankfully, we don't want them to have access to that ADA. But the other users that had had their assets locked in the white hackers wallet account, that's all coming back to people.

1:58 So we're seeing glimpses of that all coming through. And Phil here posted, to my knowledge, this is by far the largest decentralized exploit remediation in the space. Best outcome for a bad situation. And I have to agree. That's amazing. You see all these other hacks on other chains. You see millions and millions of dollars worth of assets just disappearing and there's no way to recover those assets back.

2:25 In this case, because of the white hat hacker that had taken the fund and the EMURGO stepping in and saying, hey, we'll refund all these people that were hacked and give them some money back so they're made whole again. this is the best outcome that you could ever possibly want. Would also like justice for those people that were hacked and the hackers put in prison for their crimes. But this is the best outcome for the end user that were hacked anyway. Okay, so let's have a look at the details here and find out exactly what's going on in this process. So what actually happened? Let me take you on a journey back for those that aren't up to date with everything. So from the 21st to the 23rd of June this year, 2026, a second five or X, uh,

3:12 your Roy by a Mergo. Um, we saw the hack happening, all these wallets being drained users coming online saying, Hey, all my funds have been stolen. What's going on here. I didn't put my seed phrase in anywhere and all my, my assets had just been taken. Now I did a podcast episode about this, um, as well. Uh, we could see that was linked to North Korea from what I've been, um, everyone's been told. Anyway, so the official numbers here I've put in the post here. You can go back and find all the details for yourself if you like. And then also how the exploit worked. But essentially the details of your private keys could be derived from online transactions and anything that was in your wallet once you've done

3:56 a transaction could be exploited and drained essentially. So we saw a lot of that happening unfortunately. So it was a signing bug with the private keys that could be rebuilt from public data. So there was no phishing and everything was pointing to Lazarus Group. Okay, now if you were on a hardware wallet, you were safe. So recovery phase is coming in place with the brand new tool here.

4:21 And this second-file asset recovery status update is really good. So the tool launched on the 7th of October. We've seen 100 million ADA and 22 million NITES being transferred to destination addresses and successfully verified process through their recovery requests. This is amazing. So it's a bit of a manual process at the moment. They got team members going through and checking everything, and they are now going to move to an automated process. I don't think there's too much too many assets left over in the process at the moment, so they can automate the rest and automate the smaller amounts.

4:58 that are waiting to be recovered, which is a really good thing. Now, just to protect you guys, protect yourselves when you're going through this process, the SecondFive team did put in some security notifications here. So your recovery phrase gives access to your wallet. Anyone that has your recovery phrase will be able to access your wallet. So do not give it to anyone. You will need your recovery phrase back. to go through and get your assets back.

5:27 But I'll take you through that a little bit in a moment. But never share the recovery phrase of private keys or passwords. SecondFi will never DM you any communication instructions to transfer assets. It's most likely fraudulent, guys. Don't trust that. SecondFi will never ask you to send assets to a safe verification or recovery wallet. Don't listen to that.

5:48 And don't reuse your original affected wallet because it is compromised. Don't send a transaction from it. I've been trying to tell everyone this since the compromise happened. Some comments down below argued against it. But if you don't know what you're doing, you will lose your assets. So don't use that compromised wallet. All right. Now, when in doubt, make sure you are on the website, secondfi.io. Make sure you're following the official accounts here, et cetera, et cetera. Okay, so how recovery is determined. Now, this was a lot of engineering that was happening in the background to make things happen. Now, they were using, I believe, a zero-knowledge proof process to verify that you have access and ownership

6:30 of that original wallet and could tell it to send the recovery tool to send to assets that used to belong there to your brand new wallet. And I thought that was very, very smart of how it was being done. And I'll take you through that process, but it does require a bit of memory to create that proof. Anyway, now what they did have some issues with is night allocations and external DeFi positions. So they did contact various DeFi protocols to notify them of the affected wallets and stuff and trying to preserve the positions. Some could be recovered, some can't. But the big question that everyone was asking about was the Knight allocations. So if you're using a Yoroi wallet, which many of us were, to claim your

7:20 Knight tokens, to mine them and claim them, this is the process of what's happening at the moment. So following the incident, Sacrify contacted the Midnight Foundation about the options available for claiming Knight tokens. airdrop allocations linked to affected wallets. Under the applicable claiming arrangements, these allocations remain linked to the original wallets. Now, community members have developed tools intended to address some of these difficulties. These are independent third-party tools, not part of the official SecondFi recovery process. Their availability does not mean SecondFi has verified or endorsed their security or effectiveness. Now, I am affected by this because I used UROI to do some of the browser mining. So

8:04 I have to work out how I'm going to go through this process. So I'll do a follow-up video about night allocation claiming from a compromised UROI wallet. I will work that out and I'll tell you how to do that. So if you're interested, hit that thumbs up, like, subscribe notification bell. And I'll try and keep you guys up to date with that, but that's the process here. So I'm going to find these third party tools, test them myself on a test wallet to see if they're good run through AI, see what it's actually doing in the background and verify that it's all safe and secure for you guys. Okay. Now just another safe note, do not reconnect or transact with affected wallets to pursue an airdrop or external position, unless explicitly instructed through the official second

8:53 fight recovery or migration process. Okay, all right, here we go, guys. So the second FI recovery process essentially looks like this. I can't take you through the whole process, but I will prompt you through the initial first stages here. So make sure, firstly, you are on the correct website. The URL is secondfi.io. They have basic instructions here that you can see, but here you start with the recovery process at the top. They've got general terms and conditions. Do have a look over it. Get a summary at least through AI so you know what it's talking about. Click agree and let's start the process here. Now the very first one here is entering in your recovery phrase. So if you don't have the original recovery phrase, you won't

9:41 be able to continue from this point here. Put in your recovery phrase there. Now, like I said, make sure you're on the right website. Hackers here could replicate this website, create a fake SecondFi website, push out the links and potentially steal your seed phrase and assets here. So please make sure you're on the correct website. You enter in your recovery phrase and then you'll be prompted to go through the next parts of the process here. Then you'll be reviewing what they provide you on the screen. choosing your destination wallet. So this is your brand new Cardano wallet that you would have already set up before selling this process. So you have somewhere to send your assets to, and then generating a proof that you actually own the wallet.

10:31 So that takes a little bit of time to do, and they do recommend that you have at least two gig of memory available to generate that proof that you own the wallet. So your computer will be using a lot of resources, to actually make that process possible. You'll also need a fairly new processor, so no more than five years old. And you will also need a decent internet connection. So you do have some computer requirements here to actually do this, so you won't be able to do it on your phone. Maybe a laptop, a low-end laptop might not be able to do it. So if you have a MacBook, for example, you should be able to do it on a MacBook. I've got a giant PC here under my desk, so I'll be able to go through that process as well. But the recovery process, unfortunately,

11:17 does take a bit of computational resources to actually make this happen. Now, there are some caveats in regards to the recovery process itself. Now, the numbers that are shown, they're just rough estimates and are based on the incident snapshot that happened back in, I think it was in early July. They did a snapshot of all the affected wallets.

11:39 And the final amount may differ. So you may not get as much back, unfortunately, but it's better than nothing. Now in regards to NFTs, if an NFT was stolen and couldn't be secured, you get a flat 30 ADA per NFT instead. In some situations, that's actually better because the NFT market has crashed incredibly. And one of my wallets had a lot of trash NFTs. And if they can't be recovered, Cool, I just gained 30 ADA from each one of those NFTs, which probably wouldn't sell for any more than 5 ADA. So that might be an upside in some cases, but we'll see how that one pans out for myself when I go through that recovery process.

12:26 And then staking rewards. Rewards already paid into your wallet and taken during the incident are included. Rewards that hadn't been allocated yet aren't. So just to clarify that, so if you had staking rewards that weren't claimed yet, that was stolen from your wallet, you get them back, but any rewards between the stolen time and now you won't get because they weren't earning staking rewards. They weren't claiming any of those aspects. So at least you get some of your staking rewards back, which is a really good thing.

12:56 All right, guys, to wrap things up overall, very good outcome for the majority of the community here. If you were affected by this second fire hack, hopefully, you now have your funds back. Or you're going through the process of getting your funds back. Or now you know how to get your funds back. So overall, guys, I think it is a very good outcome for what has happened.

13:19 Considering that 100 million ADA has been sent back to users, so that is a massively good outcome. 22 million Knight tokens as well, so that's really good for the Knight community too. So overall guys, I think this is a brilliant outcome. Thank you so much to EMURGO for sticking through this process and getting to the end here, committing all your time and resources to make users whole again.

13:46 Thank you so much to all the developers and teams that were working on the audits for this too. I know there were a lot of teams, different teams auditing the process to ensure that everything was working correctly. and all the people that came up with the idea of how this recovery process could actually work using zero knowledge proofs.

14:06 So that was absolutely amazing. So the whole ZK angle around this was a really good way to recover, like prove that you actually own the wallet without giving up all your seed phrase and everything else around it. So that's a really smart way of doing things. Anyway, guys, All the links down below. Make sure you do follow the official channels. Follow the official links as well to make sure that you are on the right website for this recovery process. I'll put a link to their X account.

14:37 Follow their X account or just do a search for SecondFi on X and it will lead you to the correct links and websites and whatnot. Now, guys, if you got something out of this, make sure you hit that thumbs up, like, subscribe, notification bell down below. YouTube memberships is a great way to support the channel, as well as that buy me a coffee button there too. Super quick, super easy to support the channel that way. And like always, guys, try and stay positive. We've got lots of hacks happening at the moment. I think the whole internet is compromised.

15:05 But stay positive, and I'll see you guys in the next video.