Yoroi Wallet Alternative: How to Migrate From SecondFi Safely
If you are looking for a Yoroi wallet alternative, here is the short answer: Yoroi wallet became SecondFi in April 2026, SecondFi is now being wound down after a security incident in June 2026, and every remaining balance needs to move to a brand new Cardano wallet that you control. The migration itself is not hard. The part people get wrong is the recovery phrase, and getting that wrong is what costs money. This guide walks the safe path step by step, and shows where GeroWallet fits if you want a Cardano wallet that is still actively shipping.
Written August 2026. Dates and figures below come from SecondFi's own knowledge base and EMURGO's public statements.
TL;DR
Yoroi became SecondFi in April 2026, a signing flaw drained about 16.1 million ADA from 374 addresses in June, and EMURGO is winding the product down. Do not restore your old recovery phrase anywhere. Create a brand new GeroWallet, run the SecondFi migration tool to the new address, then re-delegate your stake and your DRep. Hardware wallet users skip the transfer entirely and connect the same device to GeroWallet.
| Your situation | What to do | Cost |
|---|---|---|
| Software wallet | Create a new GeroWallet, run the migration tool, re-delegate | Network fees only |
| Hardware wallet (Ledger, Trezor, Keystone) | Connect the device to GeroWallet, no transfer needed | None |
| cNIGHT on Cardano | Moves with the sweep, then generates DUST in GeroWallet | Nothing extra |
| Bridged mNIGHT | Handle on the Midnight side, the migration tool cannot see it | Not applicable |
| One of the 374 affected addresses | Keep the old app and phrase for the claims portal | None |
Where GeroWallet fits: a non-custodial Cardano wallet with open source Apache 2.0 code, two external audit rounds on version 2.7, Ledger, Trezor and Keystone support, and Midnight on mainnet. Install GeroWallet before you start the migration.
What happened to Yoroi wallet
A quick, factual timeline, because most of the confusion comes from people catching only one half of the story.
April 2026. EMURGO announced that Yoroi wallet was becoming SecondFi, a broader finance product. Existing apps auto updated. At that point nothing was wrong and no action was needed.
June 2026. Between 21 and 23 June, unauthorised transactions drained assets from a set of SecondFi wallets. The root cause was a subtle flaw in how the software generated per transaction signatures, which allowed private keys to be derived from data that was already public on chain. SecondFi reports roughly 16.1 million ADA taken across 374 addresses, and around 129 million ADA protected by emergency measures.
July 2026 onward. EMURGO decided to wind down SecondFi and Yoroi wallet rather than resume operations. A wallet migration tool shipped in mid August 2026, and a claims and recovery portal using zero knowledge proofs was slated for early September 2026.
Yoroi wallet was one of the first light wallets Cardano ever had, and a lot of people learned self custody on it. None of what follows is a knock on that. It is simply that the product is being retired, and retired wallets do not get security patches.
The one mistake to avoid
Do not restore your old Yoroi wallet recovery phrase into a new wallet and assume you are safe.
This is the single most important line in this guide. The flaw was in the signing code, not in the seed phrase itself, but the consequence is the same: for affected wallets, the private keys behind those addresses can be derived by anyone who was watching the chain. Restoring that same phrase somewhere else recreates the exact same addresses and the exact same keys. A different wallet app does not undo a key that is already known.
So the correct move is not "restore my phrase into another wallet". The correct move is:
Create a completely new wallet, with a completely new recovery phrase, and move the assets across as a transaction. SecondFi's own migration tool is built for exactly this, and it expects you to have a destination wallet from a different provider ready before you start.
Two more rules worth repeating. Never type your recovery phrase into a website, form or app you have not independently verified. And never let anyone screen share with you to "help" with the migration, because that is the most common way people lose the rest of their balance during a wallet wind down.
How to migrate from Yoroi wallet to GeroWallet
Four steps. Read all four before you start any of them.
Step 1: Set up your destination wallet first
Install GeroWallet on Chrome, Brave or Edge and create a new wallet. Do not use the restore flow. Write the new recovery phrase down on paper, offline, and never photograph it.
GeroWallet is a non custodial Cardano wallet, which means the keys stay on your device and nobody at Gero can sign for you or freeze you out. That is the same self custody model Yoroi wallet used, so the mental model carries over. There is also an iOS app in TestFlight beta if you want mobile access, though the desktop extension is where migration is easiest.
Copy your new receiving address and paste it somewhere you can check twice. Check the first five and last five characters against the wallet screen before you use it anywhere.
Step 2: Run the SecondFi migration tool
Open the SecondFi app, find the wallet migration tool, and give it your new GeroWallet address as the destination.
The tool does more than a plain send. It unstakes the wallet, recovers the stake deposit, and sweeps ADA, native tokens and NFTs into one transfer. That saves you from paying fees on a dozen manual sends and from missing a token you forgot you held.
One hard rule from SecondFi's own documentation: never send to an exchange address. Exchange deposit addresses cannot handle a sweep like this, and assets sent there can be lost permanently. The destination has to be a wallet you hold the keys to.
Step 3: Re-delegate your stake and your DRep
Migration moves assets, not delegations. Once the funds land, your ADA is unstaked and you are no longer delegated to a DRep.
In GeroWallet, delegate again from the staking section and pick your pool. Then set your DRep delegation so your ADA counts in Cardano governance again. If you had delegated governance to the Yoroi DRep, note that this is now a separate entity from the wallet product, so re-check whether it is still the choice you want.
Neither step costs anything beyond a network fee, and rewards start accruing from the next epoch boundary.
Step 4: Do not delete the old app
Keep the SecondFi app installed and keep your old recovery phrase stored safely offline, even though you will never spend from it again.
If your wallet was one of the 374 affected addresses, the claims and recovery portal needs to be able to verify ownership of that wallet. Deleting the app or throwing away the phrase can leave you unable to prove a claim. Treat the old phrase as archived evidence, not as a usable key.
If you were on a hardware wallet
Good news: hardware wallets were not affected, because the private keys never leave the device and were never generated by the vulnerable software. Your keys are fine.
You still need a new interface, though, since the Yoroi wallet software is being retired. Hardware wallets cannot go through the in app migration tool. Instead you connect the same device to a new wallet provider using that provider's official hardware integration, and your existing accounts and balances appear as they always did.
GeroWallet supports Ledger, Trezor and Keystone, which covers the three most common devices in the Cardano ecosystem. No transfer transaction is needed for this path, no new seed phrase, and no fee. You are only changing the software that talks to the device.
Choosing your new Cardano wallet
Three things to check before you move funds
You are about to hand a new piece of software the job of protecting your ADA, so it is worth spending five minutes on diligence rather than picking whatever is top of a search result. Three questions do most of the work.
Is the code public? GeroWallet's source is on GitHub under the Apache 2.0 licence, so the signing and key handling paths can be read by anyone rather than taken on trust. Given that the SecondFi incident originated in signing code, being able to inspect that code is not an abstract virtue any more.
Has it been audited, and does it have a disclosure route? Version 2.7, released on 19 August 2026, went through two external audit rounds plus an internal review, and the repository ships a published security policy for reporting issues. You can read more on the security page.
Is it still being developed? A wallet that has stopped shipping is a wallet that will not patch its next bug. Ask when the last release was before you move funds anywhere.
What you get after the move
A migration is a good moment to look at what you actually want from a Cardano wallet, since you are setting one up from scratch anyway.
| Task | What the move means in practice |
|---|---|
| Staking | Pool delegation plus Cardano governance and DRep delegation from the same screen |
| Swapping | Gero's own DEX aggregator built into the wallet, so you are not sending funds to a separate site |
| NFTs | Gallery view for Cardano native assets, all swept across by the migration tool |
| Privacy | Midnight support on mainnet, including DUST generation from NIGHT and from cNIGHT held on Cardano |
| Safety rails | Cardano Shield scam detection and Xerberus token risk ratings on assets you interact with |
| Rewards | ADA cashback through the Bring integration across 750 plus retailers |
| Sign in | Optional passkeys and WebAuthn on top of a spending password, not instead of one |
Some of these roll out gradually through remote feature flags, so a given feature may appear a little after you install rather than on day one.
What about your NIGHT tokens
This is the question Yoroi wallet users ask most often after the ADA question, and it deserves a direct answer.
If you claimed NIGHT through the redemption flow in the Yoroi wallet mobile app, the tokens were minted as cNIGHT, a Cardano native asset, which means they sit in the same wallet as your ADA. The migration tool sweeps Cardano native assets, so cNIGHT moves across with everything else and nothing separate is required to rescue it.
One exception to check before you migrate. If you already used the protocol bridge to move cNIGHT across to the Midnight network, that portion is now mNIGHT on the Midnight ledger, not on Cardano, so a Cardano migration tool will not see it and will not move it. Bridged balances have to be handled on the Midnight side. Check both before you consider the migration finished.
Where it gets interesting is what you can do with them afterwards. GeroWallet added Midnight on mainnet in version 2.7, including in wallet DUST generation from NIGHT and from cNIGHT held on a Cardano address, with a choice of where the zero knowledge proofs are generated. In other words, tokens that were sitting idle in a wallet being retired can go straight back to work. There is background on the integration in our post on Midnight and private web3, and on the Midnight wallet page.
When a different wallet fits better
Honest answer, because a migration guide that recommends exactly one destination is a sales page.
If you only ever want a cold storage address that you touch twice a year, the simplest path is a hardware wallet paired with whatever minimal interface you already trust. You do not need staking, swap and privacy features you will never open.
If you are a stake pool operator or spend your day in Cardano developer tooling, pick on tooling depth first and check the feature list against your specific workflow before moving anything.
And if you are moving a large balance, split it. Send a small test transaction first, confirm it lands, then move the rest. That advice is wallet agnostic and it has saved more funds than any feature comparison ever will.
Frequently asked questions
How can I access my Yoroi wallet after it became SecondFi?
Your Yoroi wallet became SecondFi through an automatic app update, so the same wallet and the same recovery phrase are reachable inside the SecondFi app. That is where the migration tool lives. Access is not the end goal though, because the product is being retired: use that access to move your assets to a new wallet rather than to carry on transacting.
Is Yoroi wallet safe to use right now?
It is being retired, so it should not be used for anything except the migration tool and any recovery claim. A wallet that has stopped shipping will not receive future security patches, which makes leaving funds in it a risk that grows over time rather than shrinking.
Can I just restore my Yoroi wallet recovery phrase in GeroWallet?
You should not, if that phrase was used with the affected software. Restoring recreates the same addresses and the same keys, and those keys may already be derivable by an attacker. Create a new wallet with a new recovery phrase and move the assets as a transaction instead.
Was my wallet affected by the SecondFi incident?
SecondFi reports 374 affected addresses across four draining events, and runs a claims process for them. If your balance is intact, you are most likely unaffected, but you still need to migrate because the product is closing either way. Verify your status through SecondFi's official support channels only, never through a link sent to you in a DM.
Does migrating cost anything?
You pay standard Cardano network fees for the transfer, and for re-delegating your stake afterwards. There is no charge for creating a wallet, and hardware wallet users pay nothing at all because no transfer is needed.
How do I connect SecondFi to receive my Midnight NIGHT tokens?
You do not connect SecondFi to anything to receive them. NIGHT claimed during the Glacier Drop was minted as cNIGHT, a Cardano native asset, so it is already in your Cardano wallet next to your ADA. What you need is a destination wallet that can actually use it. Migrate the cNIGHT across with the rest of your assets, then generate DUST from it in a wallet with Midnight support on mainnet.
Will my staking rewards be interrupted?
Briefly, yes. The migration unstakes your ADA, so there is a gap until you delegate again in the new wallet and the next epoch boundary passes. Re-delegate as soon as the funds arrive to keep that gap as short as possible.
What happens to my NFTs and native tokens?
The migration tool consolidates ADA, Cardano native tokens and NFTs into a single transfer to your new address, so they move together. Check the destination wallet afterwards and confirm the count matches what you had.
Move once, and move properly
The wind down is not a reason to panic, but it is a real deadline in disguise, because a retired wallet stops getting fixes while your funds sit in it. Set up a fresh wallet, sweep everything across with the official tool, re-delegate, and archive the old phrase for any claim you may need to make.
If you want the destination wallet to be one whose code you can read, whose signing paths have been externally audited, and that is still shipping releases, install GeroWallet and create a new wallet before you start the migration. It takes about two minutes, and it means the rest of this process is just a transaction.