SecondFi says a Cardano wallet software flaw affected 16m ADA, while SlowMist says user losses may exceed $20m.