Cardano (ADA)

Great write up of the @secondfiapp hack by the CTO of @Ledger

🚨SecondFi: more than $20M stolen, or taken hostage - When the nonce is predictable, the key is public. Last Tuesday, SecondFi wallets were drained at scale. Users were doing nothing exotic, just signing transactions like any other day. Then the funds were gone. ▶️What happened. Two waves. First, external attackers drained wallets: ~16M ADA plus NFTs, around $2.5M. Then a much larger move: ~129M ADA, around $20M, swept by SecondFi itself to a third party custodian, "to keep it safe." Users were robbed by attackers, and users were swept by the platform!! ▶️The bug. Every signature scheme in this family uses a per signature secret number, the nonce. The one rule: it must be secret and unpredictable. EdDSA (Ed25519, what Cardano uses) makes it deterministic on purpose, derived from the private key and the message together. Deterministic, but secret. The secret input is the whole point. SecondFi's implementation derived it from public data alone. The nonce stopped being secret. Public in, public out. ▶️Why it

"Don't roll your own crypto" is the most repeated rule in all of security. SecondFi rolled their own, and brought back the oldest mistake in cryptography on the one algorithm designed to make it impossible. Every signature needs a secret number used exactly once, called a nonce. get it even slightly wrong, reuse it, bias it, leak a few bits, and anyone can run the math backwards and rebuild your private key from public data. this exact bug cracked the PlayStation 3 and emptied early Bitcoin wallets more than a decade ago. So cryptographers fixed it for good. Ed25519, the scheme Cardano uses, generates that nonce for you, deterministically, from your key and the message. there is no random number left for a developer to fumble. that safety is most of the reason it won. SecondFi wrote their own signer anyway, and fumbled the one thing you are not supposed to be able to fumble. their version bled a little of the key into every signature. Which means your own transaction history, sitting permanently on a public chain, was quietly spelling out your private key the whole time. the more you used the wallet, the more you leaked. and that's why there's no escape: the giveaway is already on-chain, frozen forever. you cannot un-sign the transactions that handed it over.

They did it. They actually did it. They actually managed to fuck up and reuse nonces for Ed25519 sigs. Incredible things happening on Cardano. Innovation, even. 😳

ERROR said and $ADA crashed!!

Translation: “We had a flaw in our signing code that exposed private keys Here’s a long technical explanation that carefully avoids saying it was our bug”

Seeing the Cardano community, builders and projects continue to come together despite the hurdles has been genuinely inspiring. It tells me something important about Cardano. The energy is still there. People are engaged, motivated and willing to keep building through difficult periods, even when the wider narrative often focuses on the negatives and amplifies them. When you step closer to what is actually happening across Cardano, you see something very different from the noise. You see people collaborating, solving problems, supporting each other and pushing the blockchain forward with intent. Community is critical to the future of any blockchain. Technology matters, but long term resilience comes from the people who keep showing up when conditions are not always easy, and markets are under pressure, like now. There is a lot of really cool things happening on Cardano right now that deserves more attention, and there's a few that spring to mind that have my attention. Leios has just reached an official testnet launch, after years of research and engineering work. Its purpose is to significantly increase Cardano’s scalability while preserving the security and decentralisation properties that make the layer 1 valuable in the first place. It is about giving Cardano more capacity while keeping the architecture grounded in the principles it was built on. More capacity means more room for applications, more complex use cases and more realistic demand at scale, priming Cardano for further usage and adoption pathways. Midgard is also making strong progress. Its goal is to increase transaction throughput, reduce confirmation times and lower fees by moving execution to layer 2, while still preserving the decentralisation and security guarantees of Cardano. Scalability cannot always just be about speed. It has to respect settlement, security and the cost of running the system over time, also what I like is that projects will be able to choose on how they want to approach scalability for their project or use-cases. There is also an active governance proposal for Peras, which I personally hope passes. Peras gives Cardano faster settlement confidence. Instead of waiting around 12 minutes for strong finality, Peras aims to reduce that to roughly 2 minutes. In practice, this improves confidence that a transaction is final while keeping Cardano’s layer 1 security model intact. Faster settlement confidence can improve the way capital starts to move across Cardano. It reduces uncertainty for DeFi protocols, market makers, bridges, exchanges and applications that depend on timely confirmation. Over time, that can support & contribute to deeper liquidity, better capital efficiency and more advanced financial use cases on Cardano. Leios and Peras together are an important direction. More throughput and faster settlement confidence create a stronger foundation for real usage. Pyth Pro has also recently gone live on Cardano, strengthening the blockchain’s oracle layer with high performance pricing data for DeFi protocols. Pyth aggregates real time market data from more than 100 institutional publishers, including exchanges, market makers and trading firms, into reference prices with confidence intervals for each asset. On Cardano, the model is pull based. Applications fetch the latest price update off chain, submit it to an on chain contract, and the data is cryptographically verified before a smart contract uses it. That gives Cardano DeFi better access to pricing infrastructure, which is essential for lending markets, trading protocols, stablecoins, derivatives and risk systems. This is the part that can be missed when the focus is only on conflict or short term negativity. Cardano is still advancing, if so more rapidly from research into tangible functionality in my opinion. The research is moving well into planned implementations. The infrastructure is improving. The community is still here. Builders are still building. Governance is being tested in public. The system is being pushed, challenged and strengthened both internally and externally. A long term ecosystem looks like this, one that is built by people who keep showing up, no matter how tough it gets.