SecondFi Exploit: 16.1 Million ADA Stolen and an Ultimatum Issued to the Hacker

A DeFi protocol built on Cardano has just laid its cards on the table against the perpetrator of a massive ADA token theft. SecondFi, the victim of an attack last June, has issued a public ultimatum to the hacker while keeping a bug bounty offer on the table. Behind this case, a deeply troubling lead points toward one of the most feared cybercriminal groups in the world.

SecondFi Under Pressure: 16.1 Million ADA Missing Since June

In June 2025, SecondFi — a decentralized lending protocol operating on the Cardano blockchain — fell victim to an exploit that allowed an attacker to drain 16.1 million ADA, a sum estimated at several million dollars based on prices at the time of the attack. The precise attack vector has not been fully disclosed publicly, a common practice to avoid providing a reusable blueprint for future exploits.

Several weeks after the incident, the SecondFi team published an on-chain message and a statement across its official channels, addressed directly to the hacker. The protocol is granting a final deadline to return the stolen funds in exchange for a bug bounty — a now well-established practice in the DeFi ecosystem for attempting to recover assets without immediate legal action. Should the hacker cooperate, they would be allowed to keep a portion of the funds as a legitimate reward.

This type of public ultimatum is a high-pressure negotiation strategy: by making the case visible, SecondFi increases the risk that the hacker’s wallets will be identified and blacklisted by centralized exchanges, making it far more difficult to convert the stolen ADA into fiat currency.

The Lazarus Lead: When DeFi Meets State-Sponsored Cybercrime

The most alarming element of this case is the emergence of potential links to the Lazarus Group, the North Korean hacker unit tied to Pyongyang’s Reconnaissance General Bureau. This group is notably responsible for the $1.5 billion theft from Bybit in February 2025, one of the largest hacks in crypto history.

If these links were to be confirmed, the probability of recovering the funds would collapse dramatically. Lazarus operates with sophisticated on-chain laundering techniques — mixers, cross-chain bridges, intermediary wallets — making tracing extremely complex, even for specialized firms such as Chainalysis or Elliptic. US and South Korean authorities have issued sanctions against several addresses associated with the group, but stolen funds are rarely recovered.

For the Cardano ecosystem, this incident raises legitimate questions about the security maturity of DeFi protocols built on the blockchain. Cardano stands out for its eUTxO model and its Plutus smart contract language, both considered more secure than the EVM, but no architecture is immune to logical vulnerabilities at the smart contract or interface level.

What Impact for Cardano and DeFi on ADA?

Beyond the SecondFi case, this exploit comes at a time when Cardano‘s DeFi ecosystem is trying to establish itself against competitors such as Ethereum, Solana, and Avalanche. Protocols like Minswap, Liqwid, and WingRiders have gradually attracted liquidity, but the TVL (Total Value Locked) on Cardano remains modest compared to the sector’s leading chains. A hack of this scale can erode user confidence and slow the inflow of capital.

On the price action side, ADA has not recorded any sharp move directly attributable to this incident — a sign that the market has not yet fully priced in the implications of this case, or that the relative size of the exploit is simply not large enough to weigh on Cardano‘s overall market cap. Key support levels remain closely watched by traders, particularly in a broader context of market-wide uncertainty.

SecondFi has indicated that a full post-mortem analysis will be published once the situation is resolved. In the meantime, the ultimatum remains open — and the hacker, silent.