EMURGO said it is stepping down from its role in Pentad, the five-member group coordinating Cardano’s infrastructure funding, to focus resources on recovering funds lost in the SecondFi exploit.
The attack exploited a flaw in SecondFi’s wallet address-generation system, draining roughly $2.4 million in ADA from 374 wallets.
A wallet-layer product failed, and EMURGO, one of Cardano’s founding entities, stepped back from an infrastructure coordination role as recovery work began. Cardano’s governance system, which grew during its Voltaire era, adds a second layer to the story because the product failure sits inside the same wallet environment where ordinary ADA holders delegate and vote.
Yoroi’s help documentation says users can delegate voting power to Yoroi’s own DRep, delegate to a different DRep, abstain, or select no confidence, all from inside the wallet. The same documentation ties reward withdrawal to completing one of those governance actions and routes direct voting through a GovTool connection.
Where Cardano’s governance starts
Cardano Docs describes CIP-1694 governance as a structure that combines ADA owners, delegated representatives, stake pool operators, and a constitutional committee, with participation beginning the moment a holder picks a governance-compatible wallet. That starting point makes wallet security a governance dependency for ADA holders using wallet-based delegation and voting flows.
CardanoCube’s live governance hub recorded 28 active governance actions, 379 active DReps, and 3,217 votes cast over 30 days, with 87.52 billion ADA in voting power exercised during the same window.
A compromised wallet inside that system matters because it sits in the same user flow that now carries live treasury votes and DRep delegation.
Pentad brought together Input Output, the Cardano Foundation, EMURGO, Intersect, and the Midnight Foundation to coordinate infrastructure spending across the network.
Intersect said the Cardano community approved a 70 million ADA Critical Integrations Budget in late 2025 to close gaps in stablecoins, institutional custody, cross-chain bridges, pricing oracles, and analytics.
The Cardano Foundation’s May 2026 update requested 23 million ADA in Critical Integrations V2 funding for Year 2 support covering Circle USDCx, LayerZero, Pyth, Dune, and native Fireblocks integration, routing the request through Pentad with the Foundation, Input Output, EMURGO, and Midnight as co-sponsors and Intersect as administrator.
EMURGO’s exit lands inside that active funding cycle, pulling one of the entities steering treasury-backed infrastructure away from the table just as a second funding round moves through the process.
Bitquery’s on-chain investigation traced the failure to weak randomness in SecondFi’s key-generation code, with the Cardano chain processing every transaction as designed.
The firm also reconstructed a broader swept-funds picture above 129 million ADA. That figure should be treated separately from the confirmed loss of roughly 16 million ADA, as it reflects Bitquery’s broader forensic accounting rather than the amount publicly tied to affected users.
The confirmed loss amounts to about 42,800 ADA per affected wallet, a meaningful sum for the people who held it. Compared with CardanoCube’s 87.52 billion ADA in cumulative voting power recorded across 30-day governance activity, the loss is small by voting-scale comparison, at roughly 0.018%, though that denominator reflects voting activity across governance actions rather than total ADA supply.
Measured against Cardano’s own infrastructure budgets, 16 million ADA equals about 23% of the original 70 million ADA Critical Integrations fund and about 70% of the 23 million ADA requested for Year 2.
MetricFigureWhat it showsConfirmed exploit loss~16M ADADirect custody damageAffected wallets374Concentrated user impactAverage loss per affected wallet~42,800 ADAMeaningful individual exposure30-day governance voting power87.52B ADAGovernance scale remains much largerLoss as share of 30-day voting power~0.018%Small by voting weight, large by trust impactCritical Integrations fund70M ADAExploit equals ~23% of this budgetCritical Integrations V2 request23M ADAExploit equals ~70% of this request
What comes next
A bull path could drive better wallet audits, clearer recovery flows, and broader hardware wallet adoption across Cardano’s user base, with GovTool integration improving as a direct result.
Under that path, DRep participation holds or grows, no-confidence and abstain delegations stay level, and Pentad’s remaining members keep the Critical Integrations work moving at its current pace, with the remaining four members absorbing EMURGO’s share of the coordination.
A bear path has led users to move their ADA to safety and stop there, leaving governance participation behind.
Under that path, active DReps decline, inactive DReps grow, 30-day vote counts fall below recent levels, and major treasury votes draw thinner participation, concentrating governance weight further toward large holders and professional DReps.
Bitquery’s own account keeps the failure at the wallet layer, and the public record so far ties the exploit entirely to compromised custody, with governance votes untouched by the incident.
Signal to watchBull pathBear pathActive DRepsHolds near current level or growsDeclines as users disengageInactive DRepsStays stable or fallsRises as participation fades30-day vote countHolds near or above 3,217Falls below recent levelsVoting power exercisedRemains broad and activeConcentrates among large holders and professional DRepsNo-confidence / abstain behaviorStays levelSpikes as trust weakensWallet recovery and migrationClear, completed, low-frictionDelays, confusion, or phishing copycatsPentad infrastructure workRemaining members absorb coordinationFunding work slows or becomes more contentious
EMURGO has said its focus now sits on recovery, migration, and an on-chain restitution process, leaving the permanence of its Pentad step-back unconfirmed.
SecondFi’s failure tested whether Cardano governance holds up when the wallet itself becomes the point of failure, and the answer lies in whether DReps, votes, and voting power continue to move at the pace Cardano’s governance has already reached.
