Last week i followed the recovery toll step by step. Got confirmation of all assets that were stolen. Submitted the details they required and today (4 working days later) all assets have been returned! Absolutely buzzing!! So grateful to everyone involved that help with the recovery tool and everything else that went on behind the scenes 🙏🥲

What if a token could enforce rules about who can hold it or receive it?

Cardano's Programmable Tokens standard (CIP-0113) introduces a framework for attaching configurable compliance rules to native assets.

Think of tokenized bonds, stablecoins or other regulated assets that may require approved-holder lists, transfer restrictions or freezing mechanisms.

Instead of relying entirely on external systems and manual checks, configured rules can be enforced by the ledger during transactions.

This could open interesting possibilities for real-world asset tokenization on Cardano. One important distinction: identity verification and regulatory checks may still rely on external systems; the blockchain enforces the conditions configured for the asset.

I've put together two explanations for the community:

🔹 On X: A concise six-post introduction to how programmable tokens work and why they matter.

🔹 On the Cardano Forum: A more detailed explanation of the concept, its architecture and potential use cases a french and an english version.

Explore the explanations:

• X thread
• Cardano Forum English version
• Cardano Forum Version Française

A new token launch platform came out of nowhere in the last couple days. It allows users to launch a token on pump fun or a Cardano only token on it‘s own platform using ADA.

Creators and holders both can be paid out from the fees generated. It’s been a welcome boost to the ecosystem.

solada.fun

I've heard people refer to Cardano as a digital republic in the past. I feel like this is worth a read/thinking about as people imagine the ultimate future of cardano.

Luckily I wasn’t affected during the hack and already have all my assets on an eternal wallet I set up before the hack , do I still need to migrate anything from SecondFi ? Or am I all good ?
Tia

SecondFi incident timeline and unanswered questions regarding NIGHT holders

April 22 — Yoroi rebrands to SecondFi, updates its legal terms, and requires users to accept new agreements when downloading the new app. The company also outlines plans for future features, including debit-card-style crypto transactions.

June 23 — Approximately eight weeks later, reports emerge of wallets being compromised and assets being drained.

Shortly afterward, SecondFi announces its shutdown. The timing of these events, alongside the subsequent difficulties users have experienced recovering their assets, raises several questions that I believe deserve further clarification.

July 8th - Emurgo steps down from board

One particular concern is what happens when affected users attempt to thaw their NIGHT tokens. In my case, approximately 4,500 NIGHT tokens were transferred out almost immediately after redemption, while the recovery process returned only 40 tokens. I am concerned about whether any remaining allocation can be claimed safely and what protections, if any, are available to affected holders.

I would also like to understand the scope of the incident more clearly. Were the affected wallets predominantly created during the period when users were preparing for the NIGHT distribution? How much of the stolen or affected supply has been recovered, and what is known about the destinations of the remaining assets?

Another question I would welcome clarification on is whether SecondFi, its associated entities, or individuals involved in the project held NIGHT tokens themselves, and whether any such holdings were affected by the incident.

Given SecondFi's previous relationship with EMURGO and its role in the Cardano ecosystem, I believe transparency is particularly important. What technical findings have been established regarding the wallet compromises? What happened to the unrecovered assets? And what safeguards are available to users who still have outstanding NIGHT allocations?

I am not claiming to know what happened behind the scenes, and I am not accusing any individual or organization of wrongdoing. However, the sequence of events, the recovery outcomes, and the uncertainty surrounding future NIGHT claims leave legitimate questions unanswered.

I would appreciate a factual discussion from anyone with verifiable information, official statements, or on-chain evidence that could help clarify what happened and what affected NIGHT holders can expect going forward.

I used the link on BYDFi's ADA page to get to the Cardano developer portal, then found CIP 0113 through the portal's CIPs link. CIP 0113 was still listed as Proposed when I read it. I checked the section on third-party actions to see who it allowed to trigger them.

In the document's auto-compounding example, any user was allowed to trigger the action. It also described actions that required signatures from designated keys. Those choices were defined in each token's own implementation, which the document called a substandard. The third-party script there defined both the available actions and who, if anyone, was authorised to trigger them. So I couldn't infer a token's third-party permissions from the CIP 0113 label alone.

Big one from the Cardano Foundation yesterday.

Veridian, the digital identity team that’s been building inside the Foundation for three years, is now its own company.

Veridian’s company shares now live on Cardano. These are real, legally recognized shares under Swiss law, issued on-chain using CIP-0113, the new programmable token standard. Veridian is the first company to use it.

What does Veridian actually do? It lets you prove who you are online, or prove that a company or AI agent is who it says it is, without the data sitting in a centralized database. The wallet is already live on iOS and Android, and AI agents on Masumi are already using it.

Frederik Gregaard, CEO of the Cardano Foundation and Chair of Veridian, said: “This is a milestone for the Cardano ecosystem. Veridian is built on open standards, it has a product in the market, and it is solving a problem that governments are now writing into law. The Foundation invested three years in getting it here. Spinning it out gives Veridian the independence to move at the speed its market demands, while we keep building together, including bringing verifiable identity natively to Cardano.”

Read the full announcement: https://cardanofoundation.org/blog/veridian-spinout

Explore Veridian: veridian.id

Happy to answer questions.

Jakob, CF

I've asked this question in another post but haven't received a definite answer. Hopefully someone has the answer. Despite the golden rule being to never enter your seed phrase online the SecondFi Recovery process for compromised wallets requires you to do just that so they can check that it is your wallet. All compromised wallets are empty so I guess we have nothing to lose. I'm looking for an independant confirmation that it is ok to proceed.

Once SecondFi have established that the compromised wallet is yours they will ask for the address of another wallet to which they will transfer your lost ADA and I presume tokens like NIGHT.

Before submitting via ⁠secondfi.io⁠, check Step 2 very carefully.

WhiteHat vs. Stolen funds: The tool recognizes my affected address, but only displays the very small fraction secured by their WhiteHat action. The actual assets drained by exploit bots are completely omitted and dismissed in the fine print as "not included in this recovery."

The legal trap: To claim “anything”, you must accept a mandatory clause confirming the displayed amount is a "full and final settlement," releasing SecondFi from all claims; including for any assets not shown.
The risk: Signing the proof just to collect your WhiteHat balance forfeits any legal claim to your stolen assets.
Replies on their official X account are disabled. Has anyone who suffered a bot drain seen their stolen assets listed, or has support clarified if a separate process exists?

Do not check the waiver if your drained assets are missing.
Does anybody have a similar problem with not recognised drained amounts?

Hi everyone, Ben from RealFi here.

I’m hosting Office Hours with Clay tomorrow now that RealFi is live on Cardano mainnet. We’ll talk through what’s available today, what returning testnet participants need to know, and where the product goes next.

Topics include:

• Mainnet, staking and DeFi integrations
• Points after the Pioneer Season
• EVM expansion and what the team is building towards

If you’ve tried RealFi or have questions about how it works, come and join us. You can also leave questions below and I’ll bring them to Clay.

Friday 9 October, 13:30–14:25 UTC / 14:30–15:25 BST

Live on RealFi Discord main-stage.

RSVP on Luma or join directly on Discord. Registration is optional.

SecondFi recovery dilemma

SecondFi has launched the recovery program earlier today. I figured out about the ongoing situation earlier this week when trying to open my yoroi browser extention after a long hiatus. Gave me a mini heartattack to be fair.

My situation is that I had a hardware wallet connected and also a hot wallet created in yoroi. Hardware wallet was a no brainer, no funds lost.

The thing and dilemma is that I had a hotwallet created in yoroi with some ADA on it. Created it in 2023 something and havent used it since. Other reddit post and SecondFi updates give mixed signals and messages, some to wait for the recovery program, not to withdraw in any situation, others to withdraw funds since wallet created in yoroi not updated to secondfi arent affected. Havent used Secondfi, but the yoroi app in my phone has automatically updated to SecondFi. Havent opened it tho. How to proceed?