Yoroi Wallet Recovery After the SecondFi Shutdown

Your Yoroi wallet still opens. Just not in Yoroi. EMURGO renamed the app SecondFi in April 2026, and after a security incident that June the service is being wound down for good. A forgotten spending password, a rejected recovery phrase, a new or broken phone, and an old Byron-era wallet each call for a different fix.

Start with what happened, because it decides which route is safe for you. Between 21 and 23 June 2026, attackers drained about 16.1 million ADA from 374 wallets. SecondFi identified a flaw in how the app built the signature on each transaction: a number that was supposed to stay secret could be worked out from ordinary public blockchain data, which let an attacker rebuild the private key of any address that had signed. EMURGO has since said SecondFi will not resume normal operations, and that users should move to a wallet of their own.

This reverses the usual advice: the exposure sits in the address and its key, not in the app, so carrying the same recovery phrase into Lace or Daedalus does not clean an affected wallet. SecondFi says this plainly: compromised keys stay exposed even when the phrase is imported somewhere else. For an affected wallet the phrase is spent, and the official recovery process is the route. For everyone else the phrase still works. You just use it to leave, not to reinstall.

No legitimate service, EMURGO included, will ever ask you to hand over your recovery phrase, and nobody can recover stolen ADA for an upfront fee.

What you need to recover your Yoroi wallet

Yoroi recovery comes down to two things: your recovery phrase, and knowing which type of wallet you had.

• Your recovery phrase. This is the list of words Yoroi showed you when you first set up the wallet. Every wallet created inside Yoroi gets a 15-word phrase. Yoroi can also restore a 24-word phrase if your wallet came from another Cardano app. It won’t accept a 12-word Byron phrase through its standard restore route; legacy Cardano wallets require a compatible Byron restore route, so rejection here does not mean the phrase belongs to another blockchain. The words and their order are the wallet, so keep them offline and never type them into a website.
• Your spending password is not your recovery phrase. The spending password is a short password stored only on your device, and it approves sending transactions. It never leaves your computer or phone, so no email or reset link can bring it back, but you don’t need it back: a phrase restore replaces it.
• Which era: Byron or Shelley. Cardano changed its wallet format in 2020. Wallets made after July 29, 2020 are Shelley wallets, the standard type that supports staking. Older ones are Byron wallets. Every Cardano restore screen asks which type you’re restoring, and picking the wrong one is the single most common reason a restored wallet looks empty.

How to get your ADA out of Yoroi

Four situations, four different routes. Find yours before you touch anything, because the wrong first move closes options.

You can still open the app. Then don’t restore your phrase anywhere. Update SecondFi from the App Store or Google Play and use the migration tool built into it, which sends your ADA, Cardano native tokens and NFTs to a wallet you create with another provider. EMURGO is specific about that destination: give it a new recovery phrase, and don’t reuse the words your old wallet used. Leave the SecondFi app and the old wallet in place afterwards, because the claims process may need them.

Your wallet is flagged as affected. The app shows a warning banner, and EMURGO publishes a checker. Stop there. Don’t move funds yourself, don’t withdraw staking rewards, and don’t import the phrase into another wallet, because none of that removes an exposure that lives in the key. Follow EMURGO’s official recovery process and file a claim through their support portal.

You used a hardware wallet with Yoroi. SecondFi’s assessment is that hardware wallets were not affected, through either app, because the keys never left the device. Set the device up with another Cardano wallet’s official hardware integration and your ADA stays exactly where it is.

You can’t open the app at all. A new phone, a dead laptop, a forgotten spending password: the migration tool is out of reach and the phrase is your only way back in. Restore it in a maintained Cardano wallet, Lace or Daedalus, then send the balance on to a second wallet you created with a fresh phrase. Retire the old words once you’re out.

One rule survives all four: type your recovery phrase only into wallet software you downloaded yourself from its official site. No website needs it, no support agent needs it, and anything asking for it online is a scam.

Troubleshooting common restoration issues

Most recoveries stall on one of these. Find yours.

“Invalid recovery phrase” or a word won’t verify

If the restore screen rejects the phrase or won’t let you confirm, the words don’t form a valid Cardano phrase. The usual reasons: one word is misspelled or swapped for a similar one, two words sit in the wrong order, or it’s a 12-word phrase from a different wallet that Yoroi can’t use. Each word also has to come from the fixed Cardano wordlist, so a near-miss like “recieve” won’t pass.

If you’re sure you have the right words but the order or one entry is off, the fix is to test the likely combinations methodically until the valid one appears; our invalid Yoroi recovery phrase guide has the full method.

You forgot your spending password

A forgotten spending password is fixable yourself, and you won’t need anyone else’s help: because the password lives only on your device, there’s no reset for it, but a restore from your recovery phrase replaces it with a new one during the same process.

What changed is where you do it. Don’t remove the wallet from SecondFi to re-add it: EMURGO asks users to leave the app and the old wallet in place for the claims process, and removing the wallet destroys the encrypted key data sitting on that device. Restore into a different Cardano wallet instead.

1. Confirm the phrase first: check every word against the BIP-39 word list, watch for autocorrect swaps, and if you are not certain the phrase works, test it on a spare device before you change anything.
2. Install Lace or Daedalus from its official site and choose the restore option.
3. Pick the phrase length that matches yours, 15 or 24 words.
4. Enter your recovery phrase in the correct order and set a new spending password when prompted.
5. Write the new password down offline before you close the app.
6. Send the balance on to a second wallet you created with a new phrase.

The hard case: you also lost the recovery phrase. Do not remove the wallet or uninstall Yoroi. The encrypted key data on the device is then your only copy, and removing the wallet destroys it. The password itself cannot be read out of the app - it encrypts the key material. What can be done is testing password candidates against that encrypted data, fast and offline, as long as the install is still there. Before that, try focused recall: write down every password you have ever used, note caps lock and keyboard language, and give the list twenty minutes. If the recall list runs dry, the options are: you have the wallet still installed (password testing is possible - leave it untouched), or you have most of the seed phrase (missing words can sometimes be reconstructed).

A new, broken or lost phone

The device doesn’t matter; the destination does. Don’t put Yoroi or SecondFi on the new phone. Install a maintained Cardano wallet, restore there, then move the balance to a wallet with a fresh phrase. You don’t need the old device or any exported file, because the recovery phrase is enough on its own.

The wallet restored but the balance shows zero

Two causes cover most cases. First, you restored the wrong era, a Byron phrase into a Shelley slot or the reverse; the fix is to restore again and choose the other type. Second, the phrase belongs to a wallet you’d already emptied into a newer one, so that old wallet really is at zero.
One reassurance: a zero balance on its own doesn’t mean your words are wrong. If the wallet accepted the phrase, the phrase is at least valid. Try the other era before you assume the coins are lost.

You’ve lost the recovery phrase

This is the hard one. Without the phrase there’s no built-in way in, and any service that claims to conjure one from nothing is lying.

The phrase is 15 or 24 plain words, and people store them in more places than they recall:

• A password manager, a notes app, or an email or message you sent yourself.
• A photo or screenshot in your camera roll or cloud backup.
• A paper backup: a notebook, a drawer, a safe, or the box the hardware came in.
• A second browser or phone where you once restored the same wallet.

If you have most of the words but the phrase is incomplete or out of order, a partial or shuffled phrase can sometimes be rebuilt: Yoroi uses BIP39, so dictionary and brute-force techniques can work through the gaps.
When you do find the phrase, enter it only in a maintained Cardano wallet you installed yourself from its official site. Online “phrase checkers” that offer to validate or restore it for you are a common way people get robbed.

You have an older Byron-era wallet

Byron wallets still open, but they’re the old format and don’t earn staking rewards. If your restore only works as Byron, you can keep using it, or move your ADA into a new Shelley wallet you create: you send the funds from the Byron wallet to a receiving address in the new one, the same as any normal transaction. Daedalus, Cardano’s full-node wallet, still opens Byron wallets.

If none of this gets you back in, we’ve handled Yoroi recoveries since 2019 across dozens of wallet types on a no recovery, no fee basis, and we never touch your money: once access is back you move the ADA yourself, into a wallet only you created, and you send the agreed percentage yourself. What we don’t do is undo the theft or stand in for EMURGO’s official process for affected wallets. Request a confidential assessment, no commitment.

FAQ: Yoroi Wallet Recovery

Can EMURGO or Yoroi recover my wallet for me?

No — except in one case. If your wallet was among the 374 hit in June 2026, EMURGO runs an official claims and recovery process for those funds, with a recovery portal announced for September 2026; follow that process and treat the affected keys as compromised. For everyone else, Yoroi is non-custodial and keeps no copy of your keys or recovery phrase, so the team can’t restore your wallet or reset it from their side.

How do I restore my Yoroi wallet on a new phone?

Not into Yoroi. Install a maintained Cardano app on the new phone that supports your backup format, choose its restore option, pick 15 or 24 words and type your recovery phrase. Then move the balance to a wallet you create with a new phrase. You don’t need the old device.

Why does Yoroi say my recovery phrase is invalid?

Usually a mistyped word, the wrong order, or the wrong length. Yoroi only accepts words from the BIP39 list, so anything off gets flagged, and testing close variations of the word or order in question usually finds the valid phrase.

Can I recover my Yoroi wallet without the recovery phrase?

Recovery may still be possible from an accessible installation or preserved encrypted wallet data. A forgotten spending password can sometimes be tested against those data. An incomplete or misordered phrase may also be assessable. If neither usable wallet data nor a phrase, key export or other valid backup survives, there is no material from which to restore access.

Is my ADA safe while I’m locked out?

Losing your phone or the app doesn’t move ADA. It stays recorded on the Cardano blockchain, and losing access blocks you from moving it, not from owning it. One exception matters after June 2026: if your address was among the affected ones, the balance is at risk from whoever holds the rebuilt key, so check EMURGO’s checker and follow the official process rather than waiting.