Learn Cardano Podcast

SecondFi has released more detail on the wallet security incident that saw about 16.1 million ADA, roughly US$2.6 million, withdrawn from 374 wallets between 21 and 23 June. The update includes a public warning about fake recovery emails, findings from Groom Lake's forensic investigation, and a clearer explanation of the cryptographic flaw involved.

Peter breaks down what SecondFi says happened, including the reported external attacker, the possibility of a second separate attacker, the per-transaction signature issue, and why public transaction data may have been enough to derive affected private key material under certain conditions. The episode also covers the wider discussion around cross-chain wallet code, CTRL Wallet, Yoroi migration, EMURGO tooling and the unauthorised publication of relevant code.

The key safety message is simple: use only official SecondFi channels, do not click recovery emails, never share private keys, and wait for audited recovery and migration tooling rather than trusting anyone offering support through emails, comments or direct messages.

Chapters:
0:00 Fake Recovery Email Warning
1:15 Incident Investigation Update
2:18 Second Attacker Identified
2:56 Cryptographic Root Cause
3:45 Signing Formula Breakdown
5:46 Vulnerable Wallet Library
6:37 CTRL Wallet And Yoroi
8:22 Published Code Question
9:14 SecondFi Wind Down
9:34 Recovery And Migration Tools
11:25 Private Key Safety

What you'll learn:
- SecondFi warned users that fake recovery emails are phishing attempts and that official communication is through its X account and technical support channels.
- SecondFi said the June incident involved approximately 16.1 million ADA, about US$2.6 million, stolen from 374 wallets.
- Groom Lake's independent investigation identified an external actor and suggested the primary operation may be linked to the DPRK-linked Lazarus Group.
- The investigation also identified activity from a second separate attacker affecting a different set of wallets during the same window.
- The root cause described by SecondFi was a subtle cryptographic flaw in how wallet software generated per-transaction signatures.
- The signing issue meant data that should have depended on secret information could under some conditions be computed from public blockchain data.
- SecondFi says the flaw has been patched, new wallets created with corrected software are not known to be affected, and the wallet is being wound down.
- SecondFi is preparing safe migration functionality for early August and a zero-knowledge-proof recovery tool targeted for August after specialist third-party audits.

Links & References:
⚠️ Security Alert: FAKE RECOVERY EMAIL:
- https://link.learncardano.io/m7FsGq
Official SecondFi website:
- https://link.learncardano.io/6llK2P
What happened to SecondFi:
- https://link.learncardano.io/fNJfCu
The signing math:
- https://link.learncardano.io/5Pu20K
Vulnerable Library:
- https://link.learncardano.io/cPTJG9
Andrew Westberg's Opinion:
- https://link.learncardano.io/cVwd7C
EMURGO's internal JS framework Dullahan:
- https://link.learncardano.io/0vu7M5
⚠️ Recovery Update: Bounty Offer Made to Attacker:
- https://link.learncardano.io/lG2331

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

OpenAI's sandbox escape into Hugging Face has raised a bigger question for crypto security: what happens when autonomous AI systems can chain together the same probing, credential testing, package attacks and signing weaknesses that already threaten bridges, validators and project infrastructure?

Peter breaks down why crypto attacks often start before funds move, using recent bridge exploits, the Wanchain Cardano-BNB incident, the repeated Verus bridge attacks and Rosen Bridge's blocked attempts as examples of how attackers hunt for weak points beyond smart contracts. The episode also explains why Cardano security work, responsible disclosure and access to frontier-model auditing programmes matter as AI-assisted attacks become more capable.

The practical takeaway is not panic, but risk management: understand where single points of failure sit, follow official incident updates, and think carefully about how crypto assets are stored across wallets, custody options, exchanges and offline setups.

Chapters:
0:00 AI Escapes The Sandbox
1:50 Crypto Attack Paths
3:43 Bridge Exploits Ramp Up
5:45 Wanchain Signature Failure
8:13 Rosen Bridge Defence
9:00 Cardano Security Work
11:14 Frontier Models And Disclosure
12:46 Reducing Storage Risk
15:31 SecondFi Follow Up

What you'll learn:
- OpenAI's sandbox escape into Hugging Face shows how autonomous systems can probe weaknesses, reuse exposed credentials and keep searching for deeper access.
- Crypto attacks often begin before funds move, with attackers scanning code, passwords, developer machines, packages, signing setups, bridges and administrator accounts.
- Bridge infrastructure remains a major target because locked assets can become honeypots when signing, verifier or import mechanisms fail.
- The Wanchain Cardano-BNB bridge incident centred on signed message formatting, where missing delimiters or length prefixes enabled signature reuse at much larger scale.
- Rosen Bridge reportedly blocked 84 attempts to forge rsBTC transfers from Cardano to Bitcoin, showing why bridge security monitoring matters.
- Intersect's security work has processed more than 186 vulnerability reports since January, including more than 30 legitimate issues requiring intervention.
- Cardano core repositories and critical infrastructure may need access to advanced security-auditing programmes and responsible disclosure processes as AI-assisted attack capability grows.
- Crypto holders can reduce personal risk by avoiding a single storage failure point and spreading assets across carefully secured custody and wallet setups.

Links & References:
HuggingFace got autonomously compromised:
- https://link.learncardano.io/TpAfqk
AI models escaped OpenAI’s sandbox and hit Hugging Face. Crypto is where that gets dangerous:
- https://link.learncardano.io/llhgr3
Artificial Intelligence Threat To Crypto Underestimated, Says This Influential Analyst: Security Becoming An 'AI vs AI Arms Race':
- https://link.learncardano.io/FU3DJE
Wanchain incident:
- https://link.learncardano.io/wLIpG2
- https://link.learncardano.io/DKdxbm
Bridge hacks:
- https://link.learncardano.io/6YAOQq
- https://link.learncardano.io/dCjrwh
Rosen Bridge:
- https://link.learncardano.io/sDVffu
Cardano Needs Support to Keep It Secure:
- https://link.learncardano.io/6lhuni

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

A developing Wanchain bridge incident appears to have moved 515 million bridged NIGHT tokens into the Cardano ecosystem, with rapid selling across Cardano DEXs and a sharp fall in the NIGHT price.

Peter walks through the early on-chain analysis, the Midnight Foundation's warning, why this appears localised to bridge infrastructure rather than Midnight or Cardano itself, and why bridge risk remains one of crypto's biggest attack surfaces.

Chapters:
0:00 Wanchain Bridge Anomaly
1:13 NIGHT Price Drop
1:56 Midnight's Official Warning
3:02 Who Is Affected
3:33 515M NIGHT Movement
4:40 On-Chain Flow
5:42 DEX Selling And Exits
6:13 Liqwid Borrowing Move
7:02 Monitoring The Fallout
8:18 What Is Still Unknown
8:48 Developing Story Wrap Up

What you'll learn:
- The incident appears to involve the Wanchain Cardano-to-BNB bridge and bridged NIGHT, not the Midnight network itself.
- Early analysis points to 515 million NIGHT tokens moving from a two-year-old contract, representing about 2% of supply.
- One wallet reportedly sold hundreds of millions of NIGHT across Cardano DEXs, while another wallet remained active with a large balance.
- Some DEX and bridge operators responded by pausing features or limiting exit paths while the situation developed.
- Peter warns viewers to rely on official updates, remain alert to phishing or impersonation scams, and avoid treating the price drop as a simple dip-buying opportunity.
- The episode reinforces why bridge infrastructure is a high-risk part of crypto and why formal methods and peer review matter.

Links & References:
Wanchain vulnerability affecting NIGHT:
- https://link.learncardano.io/AId82A
Official Statement from Midnight Foundation:
- https://link.learncardano.io/IBeKLO
Initial analysis from CWPaul:
- https://link.learncardano.io/CSpEn3
Watch onchain activity:
- https://link.learncardano.io/COufi4
- https://link.learncardano.io/SQQBZM
Analysis from UTXOMaestro:
- https://link.learncardano.io/ACOFNE
Watch for Updates from Wanchain:
- https://link.learncardano.io/v1Qq9z

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

This Cardano ADA news update starts with the Linux Foundation's x402 Foundation and the rise of internet-native AI agent payments. Cardano is listed through the Cardano Foundation, but the membership tier raises a bigger question: is Cardano shaping the standard, or just appearing beside it?

Peter then connects that x402 story to Masumi, Hydra, DeltaDeFi, SBI's move with Solana in Japan, AlphaGrowth, Blockfrost, and the upcoming Van Rossum hard fork. The core theme is simple: Cardano has serious technology, but the ecosystem needs stronger business development, marketing, liquidity, and user adoption if those projects are going to survive and grow.

Chapters:
0:00 Intro and x402 setup
1:18 AI agent payments explained
3:01 x402 membership tiers
5:13 Cardano associate member question
7:17 Masumi, Hydra and AI payments
9:06 DeltaDeFi pauses operations
11:51 SBI, Solana and Japan
14:10 Cardano adoption problem
15:44 AlphaGrowth proof case
19:10 Blockfrost infrastructure risk
23:46 Cardano needs marketing
26:19 Van Rossum hard fork warning

What you'll learn:
- x402 shows AI-native payments are becoming a serious internet payments category, with major finance, cloud, and crypto organisations involved.
- Cardano Foundation is present in x402 as an associate member, but Peter questions how much influence that gives Cardano over the standard.
- Masumi, Hydra, Leios, and Cardano’s eUTXO model give Cardano a credible technical stack for AI agent payments.
- DeltaDeFi pausing operations shows that strong Hydra-based products can still struggle when users, liquidity, and awareness do not arrive.
- SBI choosing Solana in Japan highlights why business development and commercial representation matter, not just technical capability.
- AlphaGrowth and Blockfrost are framed as examples of the growth and infrastructure support Cardano needs to turn technology into adoption.

Links & References:
Linux Foundation has launched the x402 Foundation:
- https://link.learncardano.io/CixMMP
Cardano Foundation has joined x402 as an Associate Member:
- https://link.learncardano.io/VZngLH
Linux Foundation Announces Operational Launch of x402 Foundation to Standardize Internet-Native Payments for AI Agents and Applications:
- https://link.learncardano.io/86s6Bs
- https://link.learncardano.io/V5qvDK
Projects on Cardano Using x402:
- https://link.learncardano.io/643BBv
- https://link.learncardano.io/5rilqG
explanation page for x402 on Cardano:
- https://link.learncardano.io/JgPgBw
DeltaDeFi operation will be paused effectively today:
- https://link.learncardano.io/pgXJud
SBI Partners with Solana Foundation:
- https://link.learncardano.io/VsLBCb
If you Build It, They Will Come:
- https://link.learncardano.io/ULtbrK
AlphaGrowth's Work on Compound:
- https://link.learncardano.io/vY9rlb
AlphaGrowth Cardano Prime:
- https://link.learncardano.io/5xOoK0
Future of Blockfrost:
- https://link.learncardano.io/mba82e
Cardano Node Update:
- https://link.learncardano.io/9C45RS
- https://link.learncardano.io/svhdpV
Pulse on Midnight:
- https://link.learncardano.io/LsYlUO

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

Peter walks through the SecondFi security incident from the perspective of checking whether a Cardano wallet may have been affected, including the official SecondFi wallet checker, support resources, and exposure checks.

This video focuses on practical safety steps: how to verify affected wallets, why you should be cautious before signing transactions from a potentially compromised wallet, and where to follow official SecondFi, Yoroi, and Lace updates.

Chapters:
0:00 SecondFi security incident
2:30 What happened and why it matters
5:00 Checking affected wallets
8:00 Where to get official support
11:00 Wallet exposure and next steps
14:00 Lace, recovery, and safety reminders
17:00 Final thoughts

What you'll learn:
- How to check whether a Cardano wallet may have been affected by the SecondFi security incident.
- Why people who previously used Yoroi or SecondFi should follow the official checker and support channels.
- What to watch out for before signing transactions from a wallet that may be compromised.
- How emergency sweeps, wallet exposure checks, and official support resources fit into the recovery process.
- Why this is general safety guidance only and not personal wallet recovery or financial advice.

Links & References:
Security Incident Update:
- https://link.learncardano.io/GWxDr4
SecondFi Incident Wallet Checker:
- https://link.learncardano.io/TY3hGy
SecondFi Support:
- https://link.learncardano.io/QOJQY6
Wallet Exposure Check:
- https://link.learncardano.io/f4yw1C
Phil UPLC:
- https://link.learncardano.io/0hv6kp
SecondFi X Account:
- https://link.learncardano.io/gZ3GOC
Lace Wallet X Account:
- https://link.learncardano.io/e4G1O8

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano