EMURGO, one of Cardano’s founding entities, has stepped back from its role in the blockchain’s Pentad governance group as it redirects resources toward recovering funds after a wallet breach that led to the loss of about $2.4 million worth of ADA.
The company said its immediate priority is reimbursing users affected by the exploit involving SecondFi, a self-custody wallet service connected to EMURGO. The incident drained 16 million ADA from 374 wallets after a flaw was found in the wallet’s address-generation mechanism.
EMURGO said the recovery process is expected to take about two weeks. The organization has also confirmed that SecondFi will be permanently shut down and will not resume service, even after additional independent security audits are completed.
The decision removes a founding Cardano organization from Pentad at a sensitive time for the network’s governance structure. Pentad was created this year as a five-member coordination group aimed at supporting major infrastructure decisions and treasury-backed development across the Cardano ecosystem.
The group includes Input Output Global, the Cardano Foundation, Intersect, the Midnight Foundation and EMURGO. With EMURGO stepping aside, questions remain about how the group will fill the vacancy, whether EMURGO’s withdrawal is temporary or permanent, and whether the organization received any allocation from the 70 million ADA Critical Integrations Budget approved in January.
Recovery effort takes priority
EMURGO said its resources are now being directed toward a dedicated asset recovery effort with one stated goal: returning funds to the 374 wallets affected by the SecondFi breach.
The company has released an online tool that allows users to check whether their wallet was among those compromised. It is also preparing a secure export function so users can move remaining assets to other platforms.
The shutdown of SecondFi marks a sharp reversal for a wallet service launched earlier this year. SecondFi was a rebranded version of Yoroi, a long-running Cardano wallet associated with EMURGO. It was designed as a self-custody tool, meaning users were responsible for controlling their own private keys and managing their assets directly.
The breach centered on the wallet’s address-generation mechanism, according to EMURGO’s previous disclosure. Address generation is a critical part of any cryptocurrency wallet because it determines how receiving addresses are created and secured. A flaw in that process can expose funds if it allows an attacker to predict, access or redirect wallet addresses.
EMURGO has not publicly provided a full technical breakdown of how the exploit was carried out. It has said the affected number of wallets was 374 and that the total amount drained was 16 million ADA, valued at roughly $2.4 million at the time of disclosure.
The organization has framed the reimbursement plan as its central operational focus. By stepping back from Pentad, EMURGO is signaling that internal resources, staffing and attention will be moved away from broader governance work and toward user compensation and asset recovery.
SecondFi will not return
EMURGO’s confirmation that SecondFi will not restart is one of the most significant developments following the breach.
The company said the wallet service will remain closed even after several independent security audits are completed. That decision suggests EMURGO sees the incident not only as a technical failure but also as one that damaged confidence in the product beyond repair.
For users, the permanent shutdown means the next practical step is migration. EMURGO’s planned export function is intended to help users move assets safely to other Cardano-compatible wallets or platforms. The company has not yet given a detailed timeline for the release of that tool beyond the broader recovery window.
The permanent closure also raises wider questions for Cardano’s wallet ecosystem. Self-custody products are central to blockchain use because they allow users to hold assets without relying on custodians. However, the SecondFi breach shows how serious the consequences can be when wallet infrastructure fails.
Security in self-custody depends not only on user behavior but also on the design and testing of wallet software. Even experienced users can be affected if a wallet’s core mechanisms contain weaknesses. That makes independent audits, open review and rapid incident response especially important for wallet providers.
EMURGO’s decision to shut down SecondFi rather than relaunch it may reduce future risk tied to that service, but it also leaves affected users waiting for reimbursement and migration support.
Governance questions remain
EMURGO’s departure from Pentad creates a governance gap in a group that was designed to coordinate Cardano’s infrastructure priorities.
Pentad was introduced as a treasury-supported initiative. A January update described it as a coalition created to address network-wide infrastructure needs. The group’s work is connected to Cardano’s broader move toward more formal on-chain governance and community-directed treasury spending.
The 70 million ADA Critical Integrations Budget approved in January was intended to support important development and integration work across the ecosystem. EMURGO has not confirmed whether it received any funds from that budget or whether any resources connected to Pentad were affected by its withdrawal.
The company has also not clarified whether it plans to rejoin the group after the recovery effort is complete. Its statement focused on the immediate need to return funds to users, leaving the long-term status of its governance role unresolved.
Those unanswered questions have fueled debate among Cardano community members. After the exploit was disclosed, some questioned whether EMURGO should continue participating in governance while managing a major security incident. Others asked whether any treasury resources connected to EMURGO should be reviewed or paused until the reimbursement process is complete.
EMURGO has not responded publicly to all questions about its financial role in Pentad or any possible allocation from the Critical Integrations Budget.
For Cardano, the issue is not only about one wallet breach. It also touches on how governance bodies handle accountability when one of their participants is involved in an operational failure. Treasury-backed programs depend on trust, transparency and clear reporting. When a key organization steps aside, the rest of the system must show how oversight continues.
A founding entity steps back
EMURGO has long been one of the most recognized names in the Cardano ecosystem. Alongside Input Output Global and the Cardano Foundation, it has been part of Cardano’s early institutional structure and has worked on adoption, commercial development and wallet products.
Its withdrawal from Pentad therefore carries symbolic weight. The move does not mean EMURGO is leaving Cardano overall, but it does mean one of the network’s original organizations is reducing its role in a key strategic body, at least for now.
Pentad’s remaining members are still major entities within the ecosystem. Input Output Global is the main engineering company historically associated with Cardano’s protocol development. The Cardano Foundation focuses on ecosystem growth, standards and adoption. Intersect supports governance and member-based coordination. The Midnight Foundation is connected to Midnight, a privacy-focused network tied to the broader Cardano technology stack.
Together, those groups are expected to continue working on infrastructure needs. But EMURGO’s absence may require adjustments to decision-making, funding oversight and workload distribution.
If the withdrawal becomes permanent, Pentad may need to define a process for replacing EMURGO or operating as a four-member body. If it is temporary, the group may still need to explain what conditions would allow EMURGO to return.
Broader ecosystem pressure
The governance change comes during a difficult period for parts of the Cardano ecosystem.
Levvy, a lending platform built on Cardano, also announced that it will cease operations by the end of July. The closure is separate from the SecondFi breach, but the timing adds to concerns about ecosystem momentum and the durability of some applications.
Lending protocols are often viewed as important pieces of decentralized finance because they allow users to borrow, lend and access liquidity without traditional intermediaries. When a platform shuts down, it can reduce available services and make traders more cautious about using smaller applications.
At the same time, Cardano’s network data has shown mixed signals. Daily transactions recently fell to a 45-day low of about 17,400, pointing to weaker near-term activity. Lower transaction numbers can reflect reduced application use, quieter market conditions or slower participation from users.
However, other figures show continued accumulation among large ADA holders. Wallets holding between 10 million and 100 million ADA increased their share of the total ADA supply from 37.66% to 38.13% in late June. That suggests larger holders expanded their positions even as day-to-day activity softened.
The network has also added 14,783 new non-empty wallets since the market bottom on June 23. A non-empty wallet is an address that holds at least some ADA or Cardano-based asset. Growth in that metric can indicate that new users are entering the ecosystem or that existing users are creating additional wallets.
These figures do not remove the pressure created by the SecondFi exploit or Levvy’s planned shutdown. But they show that Cardano is not facing a single, simple trend. Activity is weaker in some areas, while wallet growth and large-holder accumulation have continued.
Institutional developments continue
Despite the recent disruption, Cardano has also seen developments tied to regulated financial infrastructure.
Clearstream, a major European post-trade services provider, has added regulated custody support for ADA. Clearstream is part of Deutsche Börse Group and provides settlement, custody and related services for financial market participants.
Regulated custody is important because it can make it easier for professional traders, funds and institutions to hold digital assets under compliance frameworks. It does not guarantee demand, but it can reduce operational barriers for firms that require established custody arrangements before handling a cryptocurrency.
Cardano is also being watched in connection with a pending spot ETF application from Grayscale. A spot ETF would be designed to track the price of ADA directly, rather than through futures or other indirect instruments. Approval would depend on regulators and is not guaranteed.
The broader market has paid close attention to spot crypto ETF filings following the launch of spot Bitcoin ETFs in the United States and growing interest in regulated digital asset products. For Cardano, a spot ADA ETF would represent a potential new access point for traditional market participants, though the timeline and outcome remain uncertain.
Focus turns to Ouroboros Leios
Alongside governance and market developments, Cardano’s next major technical upgrade remains a key point of attention.
Ouroboros Leios, a proposed upgrade to Cardano’s consensus design, is expected to improve network throughput and scalability. Cardano founder Charles Hoskinson has said the upgrade could increase network capacity substantially.
The upgrade is being watched because scalability is central to Cardano’s long-term position. Higher capacity could allow the network to handle more transactions, support more applications and improve user experience during periods of heavier demand.
However, protocol upgrades take time. They require research, testing, implementation, community discussion and coordination among stake pool operators and ecosystem participants. Any major change to consensus must be handled carefully because errors could affect the security or stability of the chain.
For now, Ouroboros Leios remains part of Cardano’s forward-looking development story, while EMURGO’s recovery effort is an immediate operational challenge.
Trust and transparency under scrutiny
The SecondFi breach has placed EMURGO under pressure to communicate clearly and follow through on repayments.
The company has already taken several steps: it disclosed the scale of the exploit, said it would focus on reimbursement, released a wallet-checking tool, announced plans for secure exports and confirmed the permanent shutdown of SecondFi.
Still, open questions remain. Users are waiting for details on the exact reimbursement process, timing, verification standards and migration instructions. The Cardano community is also waiting for clarity on EMURGO’s Pentad status and any connection to treasury resources.
In blockchain ecosystems, incident response can shape reputation as much as the incident itself. A fast, transparent recovery process can help limit damage. A slow or unclear process can deepen concerns, especially when user funds and governance responsibilities are involved.
EMURGO’s decision to step away from Pentad may help it concentrate on affected users, but it also increases scrutiny of how Cardano’s governance groups manage continuity when a founding participant is forced to pause its role.
For now, the central issue is the recovery of 16 million ADA. The outcome of that effort will likely influence how the community judges EMURGO’s response, how Pentad moves forward, and how Cardano balances technical development with governance accountability during a period of mixed signals across the network.
Concerned about wallet security after this breach? Learn how to protect your crypto wallets effectively today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
