Ctrl Wallet shuts down after failing to recover from exploit

Traders Union
All News
Crypto
Ctrl Wallet shuts down

What users should do

Until Aug. 3, users can transfer assets from Ctrl Wallet to another exchange or crypto wallet. After that date, they will only be able to import their seed phrase into another compatible wallet. Ctrl Wallet strongly recommends withdrawing assets before the deadline.

The project team clarified that users can export 12-word or 24-word seed phrases into compatible wallets, including MetaMask, Trust Wallet and Phantom.

Ctrl Wallet also warned that it will not issue a migration token and does not plan an airdrop. Users were urged to be careful with fake social media posts and websites promising such rewards.

Ctrl Wallet was previously known as XDEFI Wallet. According to the company’s LinkedIn page, it has between 11 and 50 employees and more than 650,000 monthly users. The wallet supported more than 2,500 blockchain networks, including Cardano and Midnight.

Connection to Emurgo and the SecondFi exploit

On April 29, Ctrl Wallet announced its transition under the Emurgo umbrella. At the time, the company said its multichain architecture would continue to operate inside the SecondFi wallet.

SecondFi is a non-custodial platform built on Cardano and developed by Emurgo, the commercial arm of Cardano. In April 2026, the project rebranded from Yoroi Wallet.

On June 24, a vulnerability in SecondFi allowed attackers to drain user funds. The estimated damage amounted to about 16 million ADA, worth roughly $2.4 million at the time.

A few days later, SecondFi presented a compensation plan for affected users. According to the project, the incident affected 374 addresses. The team also said it managed to secure about 129 million ADA through emergency measures and transferred these funds to an independent third-party custodian. They will remain there until the verification and recovery process is complete.

Which wallet to choose

The Ctrl Wallet incident shows that even non-custodial online wallets do not protect users from all risks. Formally, such services do not hold assets directly and give users control over their seed phrase, but they still remain software products. If a vulnerability appears in an app, extension or infrastructure, users’ funds may be at risk.

That is why many investors use hardware wallets for the long-term storage of large amounts. Such devices store private keys offline and do not transfer them to a browser extension or mobile app. This reduces the risk of theft through an online wallet hack, malicious update, phishing website or infected device.

But a hardware wallet also does not cancel out basic security rules. Users still need to store their seed phrase securely, check addresses before sending funds and never enter a recovery phrase on websites or in apps. The main conclusion is simple: non-custodial access is important, but it does not mean full security. The larger the amount and the longer the storage period, the more sense cold storage makes.

As a reminder, the Aztec Connect vulnerability exposed risks linked to outdated DeFi contracts.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.