Non-custodial multichain cryptocurrency wallet Ctrl Wallet will shut down its services, weeks after a security exploit, and told users on Tuesday to withdraw their assets within the next month.
Ctrl Wallet reported a security issue on June 23 effecting some Cardano wallets on the platform and said it entered a temporary “maintenance mode” to protect user assets until its engineering team restores full functionality.
Earlier today, the wallet’s operators announced that starting Aug. 3, 2026, sending, receiving, swapping funds and all other actions within the app will be unavailable, except for exporting users’ recovery phrases.
The app will be removed from both app and browser extension stores, while downloads will be halted immediately, Ctrl Wallet said in a blog post.
Ahead of the Aug. 3 deadline, users can transfer their assets from Ctrl Wallet to another exchange or crypto wallet. After that, users will only be able to import their recovery phrase into another compatible wallet provider. Ctrl Wallet “strongly” recommended that users export their assets before Aug. 3.
Source: Ctrl Wallet
Ctrl Wallet said that users can export their 12-word or 24-word recovery phrase into compatible wallets, including MetaMask, Trust Wallet and Phantom.
The wallet provider said there will not be a migration token or an airdrop event and urged users to exercise caution when encountering fake social media posts or websites promising similar incentives.
Ctrl Wallet, formerly XDEFI Wallet, lists between 11 and 50 employees and over 650,000 monthly users on its LinkedIn page. The wallet supported over 2,500 blockchain networks, including Cardano and Midnight.
Ctrl Wallet transitions under the Emurgo umbrella before SecondFi exploit
On April 29, Ctrl Wallet announced its transition under the Emurgo umbrella and said that its multichain architecture will continue inside the SecondFi wallet.
SecondFi is a self-custodial platform built on Cardano that rebranded from the Yoroi wallet in April 2026 and was developed by Emurgo, the “for-profit arm of Cardano.”
On June 24, a vulnerability in SecondFi enabled attackers to drain user funds, resulting in an estimated loss of around 16 million $ADA, then worth about $2.4 million.
Days later, SecondFi revealed a recovery path to repay affected users across the 374 impacted wallet addresses. It also said it secured about 129 million $ADA through emergency measures and transferred the funds to an independent third-party custodian, where they will remain until the verification and recovery process is complete.