SecondFi has issued a deadline to the hacker who made off with 16.1 million Cardano (ADA) in a June breach. The company is demanding the stolen funds be returned, and a bounty for their recovery remains open. Investigators are now looking into possible ties between the exploit and North Korea's Lazarus Group.
The June Breach
The attack hit SecondFi in June, draining 16.1 million ADA from its systems. At current prices, that haul is worth millions of dollars. The company has not disclosed how the hacker gained access, but the scale of the theft suggests a sophisticated operation. Cardano's blockchain, known for its proof-of-stake model, has seen growing interest from both developers and criminals in recent years.
The Ultimatum and Bounty
SecondFi's response has been direct: return the funds or face consequences. The company issued a public ultimatum to the hacker, though it hasn't specified a deadline or what actions it will take if the demand is ignored. A bounty for the return of the stolen ADA is still active, offering an incentive for the hacker to cooperate. Such bounties are not uncommon in crypto heists, but they rarely lead to full restitution.
Lazarus Group Links
Emerging evidence suggests the Lazarus Group, a North Korean state-sponsored hacking collective, may be behind the theft. The group has a long track record of targeting cryptocurrency exchanges and DeFi platforms, using stolen funds to finance the regime's weapons programs. If confirmed, this would be another in a string of high-profile crypto heists attributed to Lazarus, including the $620 million Axie Infinity hack in 2022. Investigators are tracing the stolen ADA through blockchain analytics, but the group's use of mixers and cross-chain bridges makes recovery difficult.
What Happens Next
The ball is now in the hacker's court. SecondFi's ultimatum could push the attacker to negotiate, or it could be ignored entirely. The active bounty might tempt someone to flip on the hacker, but that's a long shot. Meanwhile, law enforcement agencies are likely coordinating with blockchain forensics firms to track the funds. Whether the Lazarus Group link solidifies or remains a suspicion will depend on how the stolen ADA moves in the coming weeks.
