My Cardano Wallet Was Hit by the SecondFi Incident

So it turns out that I myself had been caught up with this SecondFi hack and my wallet had been compromised. Great! So in this video I’m going to show you what I’m doing to check those processes to see what assets I’ve lost, how to actually check if my other wallets are actually compromised as well and then what you can do to start recovering your assets through their recovery process that the SecondFi team have put together. Now SecondFi was also formerly known as Yoroi so if you had been using Yoroi in the past you may be caught up in this so do check out all this stuff because it may be applicable to you.

Alright so my name’s Peter if it’s your first time here hit that thumbs up, like, subscribe, notification bell. Unfortunately you have to do this video but you know a lot of you guys out there have been asking for what to do next and there’s a lot of questions in the comments at the moment so hopefully I can take you through what you need to do. But before doing all this if you don’t know what you’re doing as soon as you sign a transaction in a compromised wallet it will expose the keys to the hacker and allow the hacker to liquidate your wallet. So if you’re looking at your wallet right now and you’re unsure that if you’re being hacked or compromised or whatever make sure you use these checkers that I’m about to show you to see if you’re a part of that initial compromise set.

If you’re on a hardware wallet you’re safe, you’re fine, you can skip this entire video but just watch it for entertainment purposes I guess so you can see what I’m doing because I’m hacked. I really have to emphasize if you don’t know what you’re doing in this whole process if you watch this whole video and you’re still a bit confused just wait for the SecondFi team to do their next big update in their wallet because they’ll do the whole migration process within the wallet itself. The Lace Wallet team have also put out an announcement about migrating to new wallets so switching wallets shouldn’t feel stressful. We know many people are feeling extra cautious about moving their funds right now so we’re building a wallet migration feature.

So if you just wait a little bit longer it’s totally cool if you do because if your wallet hadn’t been compromised yet you haven’t moved or done any transactions you should be totally fine. Waiting for the teams here to build a safe wallet migration tool could save you a lot of stress in the future so just hang tight, wait, these brand new features will really help people out. So Lace is putting in a wallet migration feature and this brand new update here a wallet security check to see if your wallet has actually been compromised or not. So let’s get into these details here.

So this is my Lace wallet this is one that I know hadn’t been compromised but you can see this checker here this brand new thing they’ve put up check this account’s transaction signatures. So here you can just click on scan it will do a quick scan through there the wallet itself and see if there’s any anomalies and see here you can see no anomalies detected so this particular wallet is safe. So I know I can transfer assets to this wallet here from a compromised one and I’ll be okay. But look at this one here this one I did a scan and it detected anomalies and I that’s when I went ah great okay let’s check out see what’s actually happened here.

So I’m going to click on my receiving wallet address here click on copy and then I can take it over to the SecondFi checker website. So this is checker.secondfi.io links down the show notes for you guys but all you need to do is paste in your wallet address here. This is essentially what you have seen in the Lace wallet side of things but here I can just click on check and it confirms that this wallet was a part of the compromised wallet set. So this is not a good thing not a good thing at all.

So furthermore I can take this now over to C-Explorer or Cardano scan I can put in my address here I can have a look at what actually has happened and then try and work out where assets have gone. So this is my address here that’s cool let’s click on that go down a little bit further yes I did delegate to Fred and you know that that’s that’s probably the transaction that compromised me. So I was playing around with my drep website I did a transaction to delegate to Fred Tanaka and my wallet was exposed the signing keys were in public and then the hacker liquidated my wallet. In this case I hope it was a white hat hacker and I’ll show you why I think it is.

So further down here I can look at my transactions and this is a transaction here so this is 22 days ago on the 23rd of June so this was around the date of just before I think the date of the hacks or I can’t remember exactly. So let’s go into this one here and have a look at what’s going on here I’ve got a total output of 35 ADA so just under 36 ADA just five dollars US six dollars US so it wasn’t big it wasn’t a big hack but it’s just still annoying. So here I can see what has gone out of my wallet and where it has gone to so this is address of where all my assets have gone in this case of 36 ADA. Now here I can see there’s two million ADA in this particular wallet last activity five hours ago I’m really hoping this is a white hat hacker because if you have a look at all the assets here these are all the NFTs there’s about 3,853 NFTs there if you look at all tokens or tokens in general we’ve got a lot of assets we got a 1,084 various different assets we’ve got several 1,800 billion Hoski tokens there we’ve got a 53,000 strike tokens so you can see there’s a lot of assets in this wallet and 22 million night tokens.

I really do think this is the white hat hacker because if it was a hacker they would have liquidated all these by doing swaps and moving over to USDCX and then exiting the ecosystem that way so I really do think this is a white hat hacker I will confirm that and put a link down below for you guys so um read the description to see if I’ve confirmed it or not. But you can see where and what has happened so my course of action right now I’ve got one thing that went against me and and that is because I’ve deleted the SecondFi app if I still had that and my wallet was still within the Yoroi SecondFi app ecosystem I’ll be able to go through their interface and then submit a support ticket and then go through the wallet features in the future to reclaim all my assets so that is the the pathway for a lot of people and if you’re watching this that’s probably what you’re going to do.

So if I now go to this website here this is support.secondfi.io I need to just create an account sign in verify myself and then put in the support request saying that this wallet was drained of x amount of assets here’s a transaction what do I do next so that that’s the process here in regards to reclaiming assets from this compromise wallet here. So if you have deleted your wallet this is what you’ll need to do if you haven’t deleted your wallet you most likely will go through that migration process once the SecondFi app has been updated which it hasn’t yet checking the SecondFi X account we’re still in quarantine mode at the moment so quarantine mode if you haven’t checked it out it’s basically just showing what’s in your wallet your wallet address and your balance if there is anything or not anything in there but it won’t let you do any transactions or whatsoever.

Now what you can do if you know what you’re doing here you can restore your seed phrase into Lace Wallet. So let’s imagine now I’ve had my Yoroi wallet there and it’s been compromised our SecondFi wallet it’s been compromised I’ve got that seed phrase and now I’ve just restored it into Lace Wallet here and this is what you’re seeing this this is now the compromised wallet from from SecondFi then I can see yeah yeah it’s been compromised and if I do have some assets left in here I can still move them out and I do have a chance and choice here to move things out. So here now I can go to the non-compromised one which was this one here click on my receiving address great and then I can go back to it let’s go back to it there we go then I can use this particular tool here this is the wallet exposure checker tool that Phil put together early on during this compromised wallet phase I don’t know what to call it this SecondFi era yeah but Phil put this together to be able to move assets out all in one transaction so there’s a lot of edge cases when it comes to moving all your assets out because if you look at your wallet you’ve got several things happening all at the same time you’ve got staking delegation you’ve got your drep delegation you may have liquidity within a not a state pool but a DeFi liquidity position so you might have liquidity pool assets locked into mint swap for example or you might have assets staked to strike finance so your wallet could have a lot of things attached to it and because of all those things one of those transactions such as unstaking your strike finance tokens would be a transaction in your wallet and then compromise your wallet the next transaction that will come through will be an automated one from the hacker liquidating all your assets so there you are trying to unlock your strike tokens from strike finance you’ve done that transaction your strike tokens come back the hacker sees it all happens and then just liquidates the rest of your wallet so it’s really important if you’re moving your assets away from your compromise wallet that you do it all in one single transaction that’s deregistering yourself from a state pool deregistering from your drep unstaking all of your liquidity positions getting that all back and then transferring that all over to your brand new wallet all in one transaction if you do not know how to do that don’t don’t continue with this video just watch it for entertainment and education purposes but don’t action anything because one transaction will compromise the rest of your wallet i can’t stress that enough so now that we are fully aware of those risks we can go back to this wallet exposure checker here and then run through this and see what options we have so first off i’m going to run the wallet checker now i’ve already connected this wallet to my lace sorry i’ve already connected this wallet exposure checker to the lace wallet so there will be a pop-up that appears you have to sign it and say yeah i want this website to have access to my lace wallet to be able to read this data so i’ve done that and yes it’s verified that the wallet has been exposed so what i can do now here is the get me out of here process so this will allow you to do a migration over to a brand new wallet so what phil here is suggesting is create a brand new wallet within lace that’s fairly easy to do so you can go back to your lace wallet here click on accounts click on add wallet create new lace wallet then kadano give this a test name like test whatever temp like migration wallet and then you have to go through your seed phrase create brand new seed phrase write that down so we’re safe secure then you can use that wallet address to migrate to the better alternative to uh migrate your wallet and assets is to a hardware wallet now at the moment lace only supports ledger and tracer so if you have a brand new ledger that you can purchase and i really highly recommend that you do i’ve got links down below in the show notes there to affiliate links where you can buy a tracer or a keystone hardware wallet they’re both fantastic hardware wallets but these wallet options will keep that c phrase off of your computer off of your device so you don’t ever have this type of compromise ever again so if you can if you do have the means if you have the money to buy a hardware wallet i highly recommend that you do links in the show notes down below for my affiliate links if you do decide to buy one does help support the channel my content and everything else out there but if you don’t that’s totally fine you can bypass it doesn’t bother me anyway hardware device highly recommend so now let’s pretend that i have done that i’ve created a brand new wallet and my brand new wallet is this one here uh 003 nami 003 okay so that’s this one here no that’s number two zero three okay so this is my brand new wallet and this is where i’m going to send my assets to so now this is my receiving address so back to the wallet exposure app destination address get me out of here let me just see that i am on my exposed wallet that’s the one that’s my exposed wallet so this is connected to the exposure wallet app this is where my assets are going then get me out of here now this will create a full transaction of everything that can be done so um it’s getting the unspent transactions withdrawable rewards register um state credentials we’re not found okay so i’m in this particular wallet i can’t do anything because my wallet’s been completely liquidated but for your situation you probably will see um assets still available and you can move things out and you can use that wallet exposure um get me out of here feature to move all your assets off all in one transaction now um phil here also mentioned to me if the if you do have liquidity positions that are stuck um within your wallet um do reach out to him because he has a way and a method to get all those things out and you may be a certain case where If you’re just staking, if you just got some tokens and you’ve been trading, you could probably move your assets out quite easily, but there may be some particular cases in DeFi where you need to take some extra precautions to not lose those particular positions.

I’ve seen a lot of people online complain that their liquidity positions have been compromised as well, and all of that has been swept. So do reach out to Phil and talk to him about those particular things. I’ll put a link down below to his ex-account so you can talk to him directly. Do be aware there are scammers out there trying to impersonate people.

I just managed to shut down another impersonator account yesterday of my own. Someone tried to impersonate me. Anyway. Phil here is a DREP as well.

You can see his DREP ID down here. So if you found this tool useful and it saved your butt, you can consider delegating to him. He has quite a bit of delegation to him already, but it’s doing good stuff. Anyway.

So that’s where we’re at at the moment. There is no new updates so far this week from SecondFi talking about what to do next. So they’re still in the quarantine mode so you can check to see within the app itself if you have been compromised. Of course, now we do have the checker website where you can check if your wallet has been compromised.

We do have that feature within Lace Wallet itself now to see if you’ve been compromised. And then soon, soon guys, just wait, just be patient. We will have the migration tools here from Lace Wallet themselves and migration tools from the SecondFi team themselves to get you out there. Highly recommend that you do get a hardware wallet if you can.

If you haven’t gotten one yet, please check out the links down below for the hardware wallets. Ledger and Nanos are fantastic, but the Keystone is my wallet of choice at the moment, my hardware wallet of choice. I pair that up personally with Eternal. Eternal is really great in terms of all its features and it’s one of the ones that support the Keystone wallet.

Of course, you can do all of this on mobile as well. I know a lot of you out there will probably be using mobile apps for all of this recovery process. I think it’s a little bit more clunky in regards to its connections and what you can do. So hence, I’m using everything on the desktop.

Anyway, guys, unfortunate that one of my wallets was compromised. It wasn’t that much of a compromise, thankfully, unlike a lot of you guys out there that I know have been complaining in the comments down below. So hopefully everyone does get their assets restored as soon as possible. I’ve seen Emurgo pass on the torch in regards to Token 2049 to the Codano Foundation, so they won’t be running the event anymore.

Their pure focus right now is recovery and getting everyone’s assets back. So that’s a really good thing to happen at the moment. Everything else is being palmed off to the rest of the ecosystem, to the other founders. Anyway, guys, if you found this video useful, hit that thumbs up, like, subscribe, notification bell, YouTube memberships down below.

I’ve got Buy Me A Coffee links there too, great way to support the channel, affiliate links to the hardware wallets as well. And I don’t know, guys, try and stay positive. It’s a shitty, shitty market at the moment, but I’ll see you guys in the next video.