Cardano’s wallet hack exposed the user layer holding its on-chain government together

EMURGO said it is stepping down from its role in Pentad, the five-member group coordinating Cardano's infrastructure funding, to focus resources on recovering funds lost in the SecondFi exploit.

The attack exploited a flaw in SecondFi's wallet address-generation system, draining roughly $2.4 million in ADA from 374 wallets.

A wallet-layer product failed, and EMURGO, one of Cardano's founding entities, stepped back from an infrastructure coordination role as recovery work began. Cardano's governance system, which grew during its Voltaire era, adds a second layer to the story because the product failure sits inside the same wallet environment where ordinary ADA holders delegate and vote.

Yoroi's help documentation says users can delegate voting power to Yoroi's own DRep, delegate to a different DRep, abstain, or select no confidence, all from inside the wallet. The same documentation ties reward withdrawal to completing one of those governance actions and routes direct voting through a GovTool connection.

A flowchart shows Cardano governance starting at the wallet, branching into DRep delegation, abstaining, no confidence, or direct GovTool voting. Where Cardano's governance starts

Cardano Docs describes CIP-1694 governance as a structure that combines ADA owners, delegated representatives, stake pool operators, and a constitutional committee, with participation beginning the moment a holder picks a governance-compatible wallet. That starting point makes wallet security a governance dependency for ADA holders using wallet-based delegation and voting flows.

CardanoCube's live governance hub recorded 28 active governance actions, 379 active DReps, and 3,217 votes cast over 30 days, with 87.52 billion ADA in voting power exercised during the same window.

A compromised wallet inside that system matters because it sits in the same user flow that now carries live treasury votes and DRep delegation.

Pentad brought together Input Output, the Cardano Foundation, EMURGO, Intersect, and the Midnight Foundation to coordinate infrastructure spending across the network.

Intersect said the Cardano community approved a 70 million ADA Critical Integrations Budget in late 2025 to close gaps in stablecoins, institutional custody, cross-chain bridges, pricing oracles, and analytics.

The Cardano Foundation's May 2026 update requested 23 million ADA in Critical Integrations V2 funding for Year 2 support covering Circle USDCx, LayerZero, Pyth, Dune, and native Fireblocks integration, routing the request through Pentad with the Foundation, Input Output, EMURGO, and Midnight as co-sponsors and Intersect as administrator.

EMURGO's exit lands inside that active funding cycle, pulling one of the entities steering treasury-backed infrastructure away from the table just as a second funding round moves through the process.

Bitquery's on-chain investigation traced the failure to weak randomness in SecondFi's key-generation code, with the Cardano chain processing every transaction as designed.

The firm also reconstructed a broader swept-funds picture above 129 million ADA. That figure should be treated separately from the confirmed loss of roughly 16 million ADA, as it reflects Bitquery's broader forensic accounting rather than the amount publicly tied to affected users.

The confirmed loss amounts to about 42,800 ADA per affected wallet, a meaningful sum for the people who held it. Compared with CardanoCube's 87.52 billion ADA in cumulative voting power recorded across 30-day governance activity, the loss is small by voting-scale comparison, at roughly 0.018%, though that denominator reflects voting activity across governance actions rather than total ADA supply.

Measured against Cardano's own infrastructure budgets, 16 million ADA equals about 23% of the original 70 million ADA Critical Integrations fund and about 70% of the 23 million ADA requested for Year 2.

Metric Figure What it shows Confirmed exploit loss ~16M ADA Direct custody damage Affected wallets 374 Concentrated user impact Average loss per affected wallet ~42,800 ADA Meaningful individual exposure 30-day governance voting power 87.52B ADA Governance scale remains much larger Loss as share of 30-day voting power ~0.018% Small by voting weight, large by trust impact Critical Integrations fund 70M ADA Exploit equals ~23% of this budget Critical Integrations V2 request 23M ADA Exploit equals ~70% of this request What comes next

A bull path could drive better wallet audits, clearer recovery flows, and broader hardware wallet adoption across Cardano's user base, with GovTool integration improving as a direct result.

Under that path, DRep participation holds or grows, no-confidence and abstain delegations stay level, and Pentad's remaining members keep the Critical Integrations work moving at its current pace, with the remaining four members absorbing EMURGO's share of the coordination.

A bear path has led users to move their ADA to safety and stop there, leaving governance participation behind.

Under that path, active DReps decline, inactive DReps grow, 30-day vote counts fall below recent levels, and major treasury votes draw thinner participation, concentrating governance weight further toward large holders and professional DReps.

Bitquery's own account keeps the failure at the wallet layer, and the public record so far ties the exploit entirely to compromised custody, with governance votes untouched by the incident.

Signal to watch Bull path Bear path Active DReps Holds near current level or grows Declines as users disengage Inactive DReps Stays stable or falls Rises as participation fades 30-day vote count Holds near or above 3,217 Falls below recent levels Voting power exercised Remains broad and active Concentrates among large holders and professional DReps No-confidence / abstain behavior Stays level Spikes as trust weakens Wallet recovery and migration Clear, completed, low-friction Delays, confusion, or phishing copycats Pentad infrastructure work Remaining members absorb coordination Funding work slows or becomes more contentious

EMURGO has said its focus now sits on recovery, migration, and an on-chain restitution process, leaving the permanence of its Pentad step-back unconfirmed.

SecondFi's failure tested whether Cardano governance holds up when the wallet itself becomes the point of failure, and the answer lies in whether DReps, votes, and voting power continue to move at the pace Cardano's governance has already reached.

The post Cardano’s wallet hack exposed the user layer holding its on-chain government together appeared first on CryptoSlate.