Burn Notice #7 | SecondFi's Deterministic Nonce Flaw, Edel Finance's 78x Oracle Manipulation, and THORChain's 39-Day Reopening
One of the three entities that founded Cardano ships a wallet, and this week a flaw in its own signing software handed attackers the private keys to 374 user addresses. An organisation that helped build the chain wrote the software that lost its own users their keys. It was the largest loss of a week that brought several more.
In today’s issue.
SecondFi blames a nonce flaw, a competing report blames a swapped dependency, and recovery is weeks out.
A flash loan inflated one tokenized-equity exchange rate by 78 times, echoing a second protocol’s loss to the same trick days earlier.
THORChain reopened after 39 days, and a forensic link ties KelpDAO and Humanity Protocol to one attacker.
Need to Know
The losses that mattered this week all traced back to inputs a team trusted and no outsider had checked lately. The same flash-loan price trick worked twice in one week on two protocols that shared no code, because each one trusted a number it should have been treating as hostile. The better outcomes came from teams that questioned their own inputs before an attacker did, whether that meant a slow manual restart or a forensic trace run long after the money had moved. If you cannot name the last time someone outside your team checked the inputs yours quietly trusts, this is the week to find out. —Adrian
The Big One. SecondFi’s Deterministic Nonce Flaw Exposed 374 Cardano Wallets
The news. Between 21 and 23 June, three separate draining events pulled roughly 16 million ADA, worth about $2.4 million at the time, out of 374 addresses on SecondFi, the wallet platform EMURGO rebranded from Yoroi in April and one of Cardano’s three founding entities. Two attacker groups were behind it, one compromising 171 wallets across two waves, the other taking 203 in a single sweep.
What broke and how. SecondFi traced the cause to a deterministic nonce derivation flaw in its proprietary signing software, one that leaked enough information every time an affected address signed a transaction for an attacker to mathematically reconstruct that address’s private key from data already sitting on the public chain. Because the exposure lives at the address level rather than the app, importing an affected seed phrase into a different wallet simply recreates the same exposed key.
A competing account complicates the story. Tibane Labs, a firm building its own wallet and staffed in part by former Mt. Gox chief executive Mark Karpelès, says the failure was not nonce reuse in the classic sense. Its report traces the fault instead to an unaudited third-party SDK that silently replaced EMURGO’s previously audited signing code on 8 June, leaving secret nonce material unset inside the Ed25519 implementation, a mechanism Tibane says it confirmed by decompiling the shipped Android build and matching it against historical signatures. The Block could not independently verify that finding, and EMURGO has not addressed the third-party SDK claim publicly, but both accounts describe the same underlying failure, in which the signing code running in production had quietly drifted from the signing code anyone had reason to trust.
Why it kept happening. Security researcher Taylor Monahan put the plainer version on record, saying SecondFi rolled its own cryptography in closed-source, unaudited software. Users treated that software as safe because a co-founding entity of Cardano shipped it, and that institutional trust stood in for the independent review the signing layer never got. A protocol can pass every audit on its contracts and still leak keys through the software that talks to those contracts, because most audit scopes stop at the chain boundary.
What to check now.
If any part of your stack depends on closed-source or vendor-supplied signing or wallet-generation code, get an independent audit of what is actually running in production rather than trusting the vendor’s own description of it.
Confirm nothing in your deployment pipeline can silently swap a dependency that touches signing logic without a review gate catching it, since Tibane Labs blames exactly that kind of substitution here.
If you maintain any Ed25519 or EdDSA signing path, verify the nonce material is genuinely secret and never falls back to a fixed or predictable value when a dependency changes underneath it.
Treat wallet-generation and signing software as part of your threat model even when you did not write it, because the KelpDAO and Bybit incidents both taught the same lesson at the infrastructure layer rather than the contract layer.
The operator move.
Signing code drifts from what was originally audited more often than most teams assume. Ask your own team what code is actually running in your production signing path this week, because a vendor’s audit report from six months ago describes a system that may no longer exist.
— Adrian
Chain Reaction. Edel Finance and DLMC Token Lost to the Same Flash-Loan Weakness
The news. Two protocols lost money to the same trick within the same week. On 1 July, a flash loan on Edel Finance’s tokenized-equities lending market inflated the exchange rate between wGOOGLx and GOOGLx by roughly 78 times its real value, letting the attacker borrow against artificially inflated collateral and drain about $403,000 from the protocol’s xStock reserves before routing the proceeds to Tornado Cash. A week earlier, on 24 June, DLMC Token lost $222,560 on BNB Chain when a flash-funded deposit exploited a circulating-supply calculation that excluded contract-held minted tokens, pushing the token’s internal price from roughly $0.41 to nearly $25 and letting the attacker redeem referral rewards at the inflated rate.
What broke and how. The mechanism is identical in both cases, even though the two protocols do not share code, a chain, or a team. Each relied on a number a flash loan can move within a single transaction, and neither checked that number against an independent source before trusting it. Edel Finance’s lending market read its exchange rate directly off a manipulable pool rather than a time-weighted or oracle-verified price, so inflating that one number for one transaction was enough to unlock the borrow. DLMC’s referral-reward calculation divided by a circulating-supply figure that excluded tokens the contract itself already held, so a single large flash-funded deposit was enough to distort the supply figure and, with it, the price the contract believed was real.
Why it kept happening. Flash-loan price manipulation is DeFi’s oldest, best-documented attack class, and both teams treated an independent price check as a nice-to-have rather than a launch requirement. Edel Finance sits inside the tokenized real-world-asset push bringing equities like Google’s stock on-chain, a category moving fast enough that some teams are shipping lending markets before internalising lessons the rest of DeFi already paid for years ago. DLMC’s exploit shows the same lesson has not fully landed even in the older parts of DeFi, on a completely different chain, in a completely different kind of contract.
What to check now.
Confirm any price or exchange-rate input your contracts trust comes from a time-weighted or multi-source oracle rather than a single pool balance a flash loan can move within one transaction.
If any calculation in your contracts divides by a circulating-supply or total-supply figure, verify it correctly excludes tokens the contract itself holds, and test that calculation against a single large deposit landing in one block.
Treat flash-loan resistance as a launch requirement for any new lending, borrowing, or reward mechanism, rather than a finding to fix after an audit flags it.
If you are building on tokenized real-world assets specifically, read the DeFi oracle-manipulation post-mortems from 2021 and 2022 before shipping, since the category is new but the bug is not.
The operator move.
Flash-loan price manipulation has been documented, exploited, and written up in public post-mortems for years, and it still worked twice this week on two protocols that had every opportunity to read about it first. An audit catches this bug easily when someone asks the right question, and teams skip asking it when the deadline is close and the check feels optional. Learn from the history before you will become an example of someone repeating the same old mistakes.
— Adrian
Around the Forums
THORChain resumed full trading on 23 June, 39 days after May’s GG20 vault compromise forced it to halt signing, swaps, and liquidity provider actions across the network. The team verified every vault and keyshare before reopening, and the ADR-028 recovery plan absorbs the loss from protocol-owned liquidity without minting new RUNE. Native Monero and Zcash swaps are next on the roadmap, worth watching given the newsletter’s own history with Zcash-adjacent bugs.
What Else Happened
Logic error in a custom ERC-4626 vault on Vault4626. A yield vault wrapping a Uniswap V3 position on Base and Arbitrum double-paid the WETH side of the underlying position, draining roughly 34 WETH, about $53,000.
Forged permit signature on Lixir Finance. An attacker exploited broken signature verification on Lixir’s wrapped vault tokens to forge a permit and drain approvals, taking about $12,300 on Ethereum.
Account takeover on Gnosis’s official X account. PeckShield flagged the compromise on 25 June and warned against interacting with any links posted from it, a takeover unrelated to the Zodiac Delay Module exploit that hit Gnosis Pay earlier in June, a separate product under the same umbrella.
A defensive win against crypto-wallet-targeting infostealers. Operation Endgame, a law enforcement coalition led by Europol, disrupted the infrastructure behind StealC and Amadey on 24 June, taking down 326 servers and 142 domains and recovering 27 million stolen credentials. StealC’s own feature list names cryptocurrency wallet data as a harvest target alongside browser credentials, and the operation also froze more than €41M in criminal crypto assets as part of the same takedown.
A forensic link between KelpDAO and Humanity Protocol. On-chain analysts traced funds from both exploits converging into the same route, evidence that investigators say rules out the insider-theft theory some raised around Humanity Protocol and points instead to a shared North Korea-linked operator behind both hacks.
Patch Notes
First, if any signing or wallet-generation code in your stack came from a vendor or a dependency you did not write yourself, confirm what is actually deployed in production against what was actually audited, per the SecondFi item above, since that exact gap went unnoticed until it was already too late. Second, patch CVE-2026-48558 today if your organisation or any MSP you rely on runs SimpleHelp for remote management, a flaw CISA has already added to its Known Exploited Vulnerabilities catalogue with a deadline of 2 July, because attackers are using it right now to install Djinn Stealer, which harvests crypto wallets and keystores alongside npm, PyPI, and cloud credentials in a single pass.
Long Reads
The Block on SecondFi’s contested root cause, the clearest available account of both the official nonce-flaw explanation and Tibane Labs’ competing supply-chain theory, alongside Taylor Monahan’s blunter framing of the underlying governance failure.
The Hacker News on the SimpleHelp to Djinn Stealer chain, with the full list of what the stealer targets, worth fifteen minutes for anyone who has ever pointed an AI coding assistant at a repo with a deployer key in it.
Crypto.news on THORChain’s technical restart, for the actual vault-by-vault and keyshare-by-keyshare verification process behind the 39-day recovery, useful reading for anyone running threshold-signed infrastructure of their own.
Cryptopolitan on the KelpDAO and Humanity Protocol fund overlap, with the clearest walkthrough of how the two laundering trails converged and what that confirms about attribution.
Adrian Hetman Burn Notice Operational intelligence for Web3, every week.