SecondFi's hack-recovery portal offers ~$8 per lost NFT — and tells victims to type their seed phrase into a webpage

SecondFi, the Cardano wallet firm behind the neo-finance platform hit by a roughly $21 million exploit in June 2026, opened its long-delayed victim recovery portal today, Protos reports. Two details stand out: a flat payout of 30 ADA — about $7.60 at current prices — for any NFT the firm can't return, and an official guide that, per Protos, recommends entering an exploited wallet's private recovery phrase into SecondFi's webpage.

Here's how the process works, according to Protos's account of the portal. Victims verify their affected wallet addresses, which are checked against an "incident snapshot" built from the June exploit. The snapshot produces "an estimated breakdown of any assets eligible for recovery" — an estimate only, with SecondFi cautioning that "the final amount may differ." Claimants must supply a newly created Cardano wallet as the destination for recovered funds. A zero-knowledge proof is then generated, which can take up to 15 minutes, before a claims process that can run up to five working days.

For NFTs that can't be returned, SecondFi says it will pay "a fixed amount" of 30 ADA — which Protos pegs at roughly $8, or $7.60 at the quoted rate — regardless of what the token was worth.

The portal itself was due in August and slipped repeatedly through September before today's launch, Protos reports.

The underlying incident, per Protos, had two parts. Criminal hackers stole about $2.4 million from Cardano wallets via a "nonce derivation" flaw that exposed users' private keys. Around the same time, a "white hat" actor moved $18.5 million out of Cardano wallets as part of the security response — the status of those funds remains unresolved. Together those figures roughly account for the ~$21 million headline. Since then, SecondFi has said it is winding down operations to focus on recovery, and Cardano-linked firm Emurgo — which Protos describes as SecondFi's creator — gave up running its Token2049 booth as a result.

Key facts

• ~$21M total tied to the June 2026 Cardano wallet exploit (Protos).
• Payout for unrecoverable NFTs: fixed 30 ADA ≈ $7.60 (Protos).
• $2.4M stolen by criminal hackers via a "nonce derivation" flaw; $18.5M moved by a "white hat" during the response (Protos).
• Portal launch slipped from August, through September, to Oct. 7, 2026 (Protos).
• Claims require a new destination wallet; ZK proof up to 15 min, processing up to 5 working days (Protos).

The real-world read The portal's own guide reportedly tells victims to type a seed phrase into a website — the single most dangerous thing a wallet user can do, exposing them to spoofing and man-in-the-middle theft on top of the hack they're already recovering from. A flat 30-ADA NFT payout ignores that NFTs vary wildly in value, so holders of anything valuable are effectively being asked to accept ~$8. And the $18.5 million "white hat" tranche is the larger share of the loss; until it's returned, "recovery" is doing a lot of work. Treat SecondFi's own snapshot figures as an interested party's estimate, which the firm itself flags as non-final.

This is news coverage, not financial advice.

Sources

• Protos (secondary reporting), Oct. 7, 2026 — portal launch, the 30-ADA NFT payout, seed-phrase warning, process mechanics, the $2.4M/$18.5M breakdown, delays, and the Emurgo/Token2049 fallout. Not sponsored.