[examples] SecondFi Cardano predictable key-generation drain (T11.004)

[iZonex]

What

Adds a worked example for the SecondFi Cardano (ADA) wallet drain disclosed 2026-06-23, mapped to OAK-T11.004 (Insufficient-Entropy Key Generation).

• New: examples/2026-06-secondfi-cardano-web-wallet-predictable-key-generation-drain.md
• Backlink in techniques/T11.004-insufficient-entropy-key-generation.md
• Regenerated STATS.md, BACKLOG.md, index.html count (646 → 647)

Why this is a clean T11.004 anchor

Multiple outlets and SlowMist confirm the root cause: SecondFi's native Cardano web-wallet key-generation software produced private keys with predictable randomness, so the entire generated cohort is derivable — including wallets not yet drained. This is OAK's first non-EVM / wallet-provider-software anchor for the class (existing anchors are EVM/Profanity), and it re-exercises both load-bearing T11.004 properties: cohort-computable exposure and the half-life-of-known-vulnerability tail.

• Confirmed: 16M ADA ($2.4M) across ~178 wallets (374 addresses per SecondFi).
• Exposure: up to 129M ADA ($20M) per SlowMist.

Developing / partially disputed — handled per OAK neutral framing

The ~129M ADA "rescue to a third-party custodian" SecondFi describes is disputed: SlowMist and community trackers link the large flows to attacker-tagged addresses (addr1q8g8c…7vuz99), and on-chain a cohort-wide sweep of derivable keys by an attacker is indistinguishable from a custodial rescue of the same wallets.

• Mechanism = confirmed; disposition = contested metadata; attribution = pseudonymous.
• Entry is explicitly marked developing / partially-disputed with a re-map path: add T5.007 / T11.010 as co-primary disposition if forensics confirm the flow is operator-controlled.
• The entry does not amplify SecondFi's "do nothing / don't restore your seed / submit a claim" guidance — for a weak-entropy cohort, immediate rotation to a cleanly generated key is the only protective action, and inaction is the failure mode. The literal "restoring the same phrase doesn't help" is true; "leave funds in place and wait" is not.

Validation

All gates pass: check_linkage OK · check_backlinks 0 hard / 0 warn · check_integrity clean · markdownlint 0 errors · verify_citations clean. Exports (oak.json / oak-stix.json) and SPECS.md unchanged (examples aren't part of those artifacts). Citations are inline-only (no new bibtex entries).

🤖 Generated with Claude Code