Do Not Claim Your NIGHT Tokens: Why SecondFi Is Telling Hack Victims to Walk Away From Tomorrows Midnight Redemption

Do Not Claim Your NIGHT Tokens: Why SecondFi Is Telling Hack Victims to Walk Away From Tomorrow’s Midnight Redemption

Cardano ecosystem wallet platform SecondFi has issued an urgent warning to users hit by its June security incident: do not claim your upcoming NIGHT token allocations, because Midnight’s redemption system only pays out through the original — and still compromised — wallet address.

Some users affected by the June incident are scheduled to claim NIGHT tokens on Sept. 22 under Midnight’s Glacier Drop distribution schedule. But the wallets tied to those allocations remain permanently compromised, and SecondFi says it has no way to protect the tokens once they land in an exposed address.

The problem, according to SecondFi, is structural. Midnight’s claim system requires NIGHT allocations to be redeemed through the original wallet and does not support moving an allocation to a different address before it is claimed. SecondFi said it contacted the Midnight Foundation to explore alternative claiming options before issuing the warning, but no workaround exists so far.

SecondFi’s guidance effectively tells holders that the only options are leaving the NIGHT allocation unclaimed or redeeming it into a wallet whose private key may already be in an attacker’s hands — and the company explicitly advises against the latter.

Why the wallets can never be safe again

The warning traces back to the SecondFi wallet security incident that unfolded between June 21 and June 23. An independent investigation commissioned by EMURGO found that approximately 16.1 million ADA, valued at roughly 2.6 million USD at the time, was stolen from 374 wallets.

SecondFi traced the root cause to a cryptographic flaw in how its wallet software generated signatures for individual transactions. A value that should have depended on secret information could, under certain conditions, be calculated using publicly available transaction data already recorded on the Cardano blockchain.

That distinction matters. Unlike a temporary application bug that can be patched and forgotten, the exposure remains permanently tied to the affected addresses and their private keys. Anyone holding the public blockchain data could, in theory, derive the private key material for those addresses. SecondFi has patched the flaw, and wallets created with the corrected software are not known to be vulnerable — but the old addresses can never be considered safe again.

Forensic investigators hired by EMURGO, blockchain intelligence firm Groom Lake, reviewed code, code history and public blockchain records. The investigation found evidence of two separate attackers: a primary operation described as sophisticated, externally funded and showing indicators being assessed for possible overlap with the DPRK-linked Lazarus Group, plus a second party that targeted a separate group of wallets during the same window.

Recovery tools don’t cover NIGHT

Since the incident, SecondFi has split its response into two tracks. Its Wallet Migration Tool lets users move eligible ADA, Cardano native tokens and NFTs still sitting in SecondFi wallets to freshly created wallets with another provider. A separate recovery effort — built around a zero-knowledge-proof portal that lets users prove ownership of compromised wallets — covers assets affected by the June incident.

Neither tool can help with NIGHT. The allocation has not yet entered the compromised wallet, and the claiming rules are controlled entirely by the Midnight Foundation, not SecondFi. As an emergency measure during the incident, SecondFi moved roughly 129 million ADA to an independent third-party custodian, but that safeguard also does not extend to future token claims.

The NIGHT token itself belongs to Midnight, a privacy-focused network built on zero-knowledge technology that launched its mainnet in March. NIGHT was distributed to eligible users through the Glacier Drop program, with allocations unlocking under scheduled redemption periods — a design that has now collided with SecondFi’s compromised addresses.

A platform that will not reopen

The NIGHT warning lands on top of an already bleak situation for SecondFi users. EMURGO confirmed in July that the wallet platform would not resume normal operations, and all remaining work on the platform has been redirected toward migration, claims and asset recovery.

SecondFi has told users not to delete the app and to keep their seed phrases, since at least one of the two will be needed for the recovery process. Users who already deleted the application must retain their seed phrase to recover eligible assets.

The company has also cautioned the community against fake recovery services and impersonators, stressing that SecondFi will never ask for private keys, recovery phrases or wallet credentials, and that its official tools never require users to sign a transaction simply to check whether an address was affected.

For NIGHT holders staring at a redemption date, SecondFi’s advice is blunt: direct questions about a safer claiming method to the Midnight Foundation, because changes to the claim process remain outside SecondFi’s control. Until Midnight offers an alternative, the safest move for affected users may be to let the allocation sit unclaimed rather than hand freshly minted NIGHT to the hackers who never left.