Cardano (ADA)

Eyyy @hoskytoken ! 🦴 WTF is up with this demure post? Gov dashboard looking smashing good!! Corporate Communications department on vacation or something?😅 https://t.co/R3gnTngTot

🚨SecondFi: more than $20M stolen, or taken hostage - When the nonce is public, the key is public. Yesterday SecondFi wallets were drained at scale. Users were doing nothing exotic, just signing transactions like any other day. Then the funds were gone. ▶ What happened. Two waves. First, external attackers drained wallets: ~16M ADA + NFTs, around $2.5M. Then a much larger move: ~129M ADA, around $20M, swept by SecondFi itself to a third party custodian, "to keep it safe." Both are true at once: users were robbed by attackers, and users were swept by the platform. ▶ The bug. Every signature scheme in this family uses a per signature secret value, the nonce. The one rule: it must be secret and unpredictable. EdDSA (Ed25519, what Cardano uses) makes it deterministic on purpose, r = H(secret_prefix || message). Deterministic, but secret. That secret half is the whole point. SecondFi shipped r = H(message). In the latest web implementation, they dropped the secret. The nonce became a pure function of the transaction. Public in, public out. ▶ Why it is fatal. It's worse than nonce reuse. Reuse needs two signatures. Here the nonce is H(message) and the message is on chain, so one signature is enough: s = r + c·secret with r and c both public, so secret = (s - r)/c. Every transaction a user ever signed is a public disclosure of their private key. I pulled signatures off chain and rebuilt the keys to confirm. One signature, every time. ▶ The "rescue." The second wave was the platform sweeping ~129M ADA to a custodian, framed as protection. The fix for "your keys are cryptographically exposed" was "trust us to give it back." A cryptographic failure patched with a social promise. "We will return the funds" is not "we are cryptographically incapable of keeping them." The incident did not create that gap. It made it visible. ▶ The ownership trap. Once a key is publicly reconstructible, holding it proves nothing. Attacker, custodian, original user: three parties, same cryptographic claim. So how does a real owner prove it? The elegant exit would be a zero knowledge proof of knowledge of the 24 words, the seed, without revealing it. Knowledge of the mnemonic is the one thing a chain scraper does not have. Prove the preimage, not the key. ▶ How did it get in? Honest mistake, or planted? r = H(message) instead of r = H(secret || message) is a one token change. Exactly what a tired engineer writes, and exactly what a supply chain or insider attacker plants, because it is deniable and pays out silently to whoever reads the chain. I do not know which one this was. The commit history will tell. Cryptography does not care about good intentions. It enforces what you built. SecondFi built a scheme where the nonce was public, so the keys were public, so the funds were anyone's. The rest is just who read the chain first. Stay safe. -- Kudos to @coinspect for the final finding.

JUST IN: CoinMarketCap ranks #Cardano $ADA as the 5th most bullish community sentiment.

Wayback machine says there has been one change in the @secondfiapp page, today. When exploring the SecondFi terms and conditions, this correlates well - as the terms and conditions have recently been updated. What were the previous terms & conditions? Why change them now? @emurgo_io

We're going live Thursday, June 25 at 12PM ET with Zachary Soesbee(@CashAnvil). We're discussing Cardano, decentralized governance, and why the tools to opt out of the system may already exist. Join us on X or YouTube. Set your reminder - https://t.co/gDTikYJmna https://t.co/VAUeOczE8B

#Cardano fam, tbh, if things don’t drastically change, @emurgo_io voluntarily agrees to return their $ADA to the community and all major Entities agree to greater oversight and accountability to the community, under these circumstances Hard Forking the chain and having a proof of burn may be necessary to save what we have all built, sweated and bleed for. Bad actors and incompetent ones cannot be allowed to remain…… @IOHK_Charles @jasonappleton