SecondFi: the ZK rescue, from idea to deployment

# SecondFi: the ZK rescue, from idea to deployment

On October 20, SecondFi (the wallet formerly known as Yoroi) announced that since the launch of its recovery tool — October 7 — it has returned more than 100 million ADA and 22 million NIGHT to the destination addresses of verified requests. Phil UPLC (@phil_uplc), CEO and founder of Anastasia Labs, summed it up with an ambitious phrase: “as far as I know, this is the largest remediation of a decentralized exploit in the entire space.”

We went to verify it. And what we found is more interesting than the headline: the size of the recovery is not the notable part. The notable part is how it was done — with a piece of engineering that until recently only existed as an idea in an academic paper.

First, the verifiable part: the funds did come back

We don’t repeat the headline, we check it against the chain. We queried the Cardano blockchain with our dbsync node and found that the figure is credible — it even falls short:

• The recovery wallets are empty today. The funds secured in June went out to their destination: the EMURGO recovery fund and the rescue wallets were left with balances of 1 to 155 ADA.
• The recovery fund distributed 116.66M ADA in October, with the peak pinned between October 7 and 9 — exactly when the tool launched. There were tranches of 15.9M ADA and dozens of individual reimbursements of 60-115 ADA to victims.
• The NIGHT token also moved (policy 0691b2fe…, with a supply of 24 billion, identifiable without ambiguity).

In other words: SecondFi says “100M+ returned,” and the chain confirms that 116.66M ADA left the fund in that window.

So is it “the largest remediation in the space,” as Phil said? In dollars, no. Poly Network returned ~$611M in 2021 and Euler Finance ~$197M in 2023; SecondFi’s ~129M ADA (≈ $20M at June’s price) sits 30× and 10× below. But in the Cardano ecosystem — whose mainnet was never compromised — SecondFi is the largest remediation in its history.

A note of context before continuing: Phil is not a neutral observer. He is the CEO of Anastasia Labs — the firm behind Midgard, Cardano’s first optimistic rollup — who, according to the “company” field of the main contributor to the proof-tool repository, likely built the recovery tool. His “largest remediation in the space” is, in part, author’s pride, not an independent assessment. That’s why we don’t take it at face value: we check it against the chain and against history.

The real headline is elsewhere.

The problem ZK solved

To understand what SecondFi did, you have to understand the problem. The June 2026 exploit was a deterministic nonce bug in the Ed25519 signature: a wallet component (the @stashers.io/trantor SDK) replaced the audited library and generated signatures with a reused value. The consequence is brutal and counterintuitive:

Signing = exposing your private key. Every signature made with the affected wallet hands the attacker the information needed to derive the key.

So, in a normal recovery, proving you own a wallet is easy: you sign a message with your private key. But here, signing was exactly what you couldn’t do, because the very act of authenticating you exposed you again. The traditional methods were ruled out:

• Signature (challenge-response) → leaks the key with the broken nonce.
• Manual KYC → doesn’t scale to thousands of users and doesn’t prove control of the key.
• Custodian snapshot → centralized and doesn’t distinguish the legitimate owner from the attacker.

SecondFi needed a way to prove “I control this wallet” without signing anything.

The solution: proving ownership without signing, with ZK

The recovery tool uses zero-knowledge proofs. A ZK circuit (Groth16, on the gnark library) proves that the user knows the master extended private key that derives their credential m/1852’/1815’/account’/role/index (Cardano’s CIP-1852 standard), with the public key as the only public input.

The key point: the proof runs through a different computational path and never invokes the compromised Ed25519 signing function. Instead of signing (which leaks the key), you generate a mathematical proof that you can derive that address. And a nuance that matters: the recovery phrase is used locally in your browser to generate the proof; it is not stored or transmitted — only the proof is sent, with the destination address fixed inside it.

All of this was independently audited by zkSecurity: the two serious findings were in the third-party library (gnark) and have already been fixed and re-verified; the remaining two, in the project’s own repository, are not exploitable in practice.

What’s actually new: not the cryptography, the deployment

And here’s the point that gives this story fresh air, and that’s worth saying honestly:

The idea wasn’t new. Proving that a key derives from a seed without revealing it was already published: AmericanFortress described exactly this in two 2026 papers (ZKPoSP, IACR ePrint 2026/1508, and Provenance Proofs, 2026/2204), with a revealing clarification: “not yet deployed in production.” a16z also published ZK for airdrop claims, and Tornado Cash already proved membership without revealing which note.

What’s new is that SecondFi deployed it. Running Groth16 in a browser is not trivial — the proving key weighs ~1.2 GiB. SecondFi wrote seven patches of its own to gnark/gnark-crypto so that a victim could generate the proof in their own browser in ~15 minutes, without heavy infrastructure. They took an idea that was in a paper, and turned it into a production system that is returning real funds to real victims today.

That’s the difference between an idea and a deployment. And it’s what makes SecondFi’s mechanism unique: as far as we could verify, it’s the first application of ZK in production to recover funds from a wallet with a compromised key.

The questions that remain open

The chain confirms the return, but not everything is closed:

1. How much is left, exactly? The fund moved 116.66M ADA; SecondFi reports 100M+ to victims. The difference (internal consolidations vs. net reimbursements) deserves a fine breakdown.
2. The “preventive rescue” narrative has a counterpart. Fetch’s analysis reads it as the team + white-hats securing the ~129M before the attacker; Bitquery’s, as an attacker hub sweeping ~135M and sending it to a vault that went inactive. It’s not proven which reading is correct, and that has to be said.
3. Automation (fulfilment via smart contract) was “in the coming days” as of October 20.

Protect yourself: only official channels

With distribution underway, scam attempts against affected users have grown. SecondFi’s official rules: never share your recovery phrase, private key, or password with anyone; SecondFi never writes to you first; don’t send funds to a “recovery wallet” or pay a fee to unlock your claim; and when in doubt, go directly to secondfi.io and verify the links yourself.

---

Sources: official SecondFi announcement (Oct 20, 2026, @secondfiapp) · Fetch on-chain analysis (Jul 14, 2026) · Bitquery on-chain analysis (Jun 24, 2026) · zkSecurity audit of the proof-tool · AmericanFortress, IACR ePrint 2026/1508 and 2026/2204 · a16z crypto (ZK airdrops) · our own dbsync verification (snapshot Oct 21, 2026). Full links in the published version.