Ctrl Wallet — Security Exploit and Forced Shutdown
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4x9GRx…rPtxSummary
Ctrl Wallet, a multi-chain self-custodial wallet formerly known as XDEFI Wallet and supporting over 2,500 blockchain networks with approximately 650,000 monthly active users, permanently ceased operations on August 3, 2026 following an unrecovered June 2026 cryptographic exploit. The exploit targeted the Cardano integration layer operated by SecondFi (formerly Yoroi Wallet), a platform under the same EMURGO parent, draining approximately 16.1 million ADA (roughly $2.4–$2.6 million USD) from 374 wallet addresses via a signing flaw that allowed private key material to be reconstructed from public blockchain data. Users who did not export recovery phrases before the August 3 deadline may face permanent loss of access to remaining funds.
Connected Entities
6 entities · 59 linked investigations- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→Phantom Wallet(60%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→Cardano(80%)
- SecondFi (Cardano Wallet)→mentioned with→Cardano(80%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→SecondFi (Cardano Wallet)(80%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(75%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→Trust Wallet(80%)
Connected Through
6 shared actors · 102 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Phantom Walletorganization
- □KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarusorganization
- □Trust Walletorganization
- □Cardanoorganization
Timeline(13 events)
17 July 2024
XDEFI Wallet publicly rebrands to Ctrl Wallet, announcing enhanced multichain features and new user onboarding focus.
Crypto Daily17 October 2024
Ctrl Wallet initiates $XDEFI to $CTRL token migration at a 1:1 ratio, with the $XDEFI token scheduled to deprecate September 25, 2025.
The Defiant29 April 2026
EMURGO, commercial arm of Cardano, acquires Ctrl Wallet's technology infrastructure. The $CTRL token is explicitly excluded from the deal. EMURGO simultaneously rebrands Yoroi Wallet to SecondFi.
CoinTrust21 June 2026
First wave of coordinated attacks begins against SecondFi Cardano wallets, exploiting a cryptographic signing flaw to reconstruct private keys from public transaction data.
SecondFi Knowledge Base (official)22 June 2026
SecondFi detects the breach and activates emergency response protocols. Platform placed in maintenance mode.
SecondFi Knowledge Base (official)23 June 2026
Ctrl Wallet publicly discloses a security vulnerability affecting Cardano-linked wallets. Additional attack waves continue. Total theft reaches approximately 16.1 million ADA across 374 addresses.
Crypto.News24 June 2026
CoinDesk reports the exploit publicly. SecondFi team states approximately 129 million ADA has been secured via emergency containment and transferred to an independent third-party custodian. SlowMist estimates total exposure could have exceeded $20 million.
CoinDesk25 June 2026
Root cause of the cryptographic signing flaw identified and patched in the developer codebase. Final balance snapshot captured on June 26.
SecondFi Knowledge Base (official)9 July 2026
Ctrl Wallet announces permanent shutdown effective August 3, 2026. New downloads halted immediately. App removal from stores begins.
CoinTelegraph22 July 2026
SecondFi publicly details the cryptographic flaw. Groom Lake's forensic report cites two distinct attackers; Attacker A flagged with possible DPRK/Lazarus Group indicators. SecondFi and Yoroi Wallet announce permanent shutdown.
CoinDesk27 July 2026
SecondFi and EMURGO publish compensation plan developed alongside Input Output Group and the Cardano Foundation, centered on a zero-knowledge proof recovery portal.
Cryptonomist3 August 2026
Ctrl Wallet permanently ceases operations. All transfer, swap, and dApp functions disabled. Recovery phrase export functionality retained temporarily. App fully removed from Apple App Store, Google Play, and browser extension stores.
Crypto.NewsDecision Log
- slot 457771959 · hash JUUvBiWgtxkvp4CjRAVstJMviijSyJ5Z8kBk69qkiYn
- slot 443519887 · hash 2RbJpYGnZdgh7JwqN7xM7yx8MtA45gEZzhffsGpemQTD
- slot 443519884 · hash A2bzE2o2pcRT8kc3MJgNB6r2VXJZHxSYriqgUJAGSq3X
- slot 443504224 · hash UJ4UHXqWCrXoL2uRPdsmD1jp29peNtUZ49prfQgjYp5
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 23 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/4/2026, 11:23:31 PM
last updated: 8/26/2026, 10:05:09 AM
5 viewsavoid.net — verified advice for a post-truth world