Ctrl Wallet — Security Exploit and Forced Shutdown
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4x9GRx…rPtxSummary
Ctrl Wallet, a multi-chain self-custodial wallet formerly known as XDEFI Wallet and supporting over 2,500 blockchain networks with approximately 650,000 monthly active users, permanently ceased operations on August 3, 2026 following an unrecovered June 2026 cryptographic exploit. The exploit targeted the Cardano integration layer operated by SecondFi (formerly Yoroi Wallet), a platform under the same EMURGO parent, draining approximately 16.1 million ADA (roughly $2.4–$2.6 million USD) from 374 wallet addresses via a signing flaw that allowed private key material to be reconstructed from public blockchain data. Users who did not export recovery phrases before the August 3 deadline may face permanent loss of access to remaining funds.
Connected Entities
6 entities · 60 linked investigations- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→Phantom Wallet(60%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→Cardano(80%)
- SecondFi (Cardano Wallet)→mentioned with→Cardano(80%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→SecondFi (Cardano Wallet)(80%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(75%)
- Ctrl Wallet — Security Exploit and Forced Shutdown→mentioned with→Trust Wallet(80%)
Connected Through
6 shared actors · 119 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Phantom Walletorganizationalso inMastra AI npm Supply Chain Attack (June 2026)·0node-gyp npm Supply Chain Compromise (June 2026)·0Uniswap Google Ad Phishing Campaign (May 2026)·0UNK_DeadDrop North Korea Developer Phishing Campaign·0Miasma npm Supply Chain Attack (Red Hat)·0Solana Blinks / Durable-Nonce Drainer Kits (2026)·0World Cup 2026 — Stake.com Impersonation Wallet Drainer Campaign·0Fake Jupiter CJUP Airdrop Phishing Campaign·0TeamPCP / Mini Shai-Hulud npm Supply Chain Worm·0Sector Drainer — DaaS Wallet Drainer with Phantom 0-Day Bypass·0Fake Uniswap V4 Airdrop Phishing Network (2026)·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0easy-day-js / Mastra npm Supply Chain Attack·0Phantom Gyp npm Supply Chain Attack (June 2026)·0Rugproof (Solana Launchpad)·0Fake MetaMask Update Phishing Campaign (May 2026)·0Cryptomus / Xeltox Enterprises Ltd.·0Quark Drainer·0GSD Cloud / Lex Christopherson·0AsyncAPI npm Supply Chain Attack (Miasma RAT) — July 2026·0Solidity Pro VSCode Extension (Malicious)·0CastleLoader / NeedleStealer Crypto Wallet Malware Campaign·0Morocoin / Berge Blockchain / Cirkor·0Donald G. Basile / Bitcoin Latinum (LTNM)·2Donald Basile / Bitcoin Latinum (LTNM) / Monsoon Blockchain Corporation·2Rublevka Team·2Leo Platform npm Supply Chain Attack (June 2026)·3Miasma npm Supply Chain Attack·5DeepSnitch AI·12WAYGU CASH·18BullX·27LiFi Finance·32Grass·38LiFi Protocol·38Leap Wallet·52Fuse Wallet·54Lulo·55Transak·55Famous Fox Federation·57Phantom Wallet·63Kaspa·64Dialect·69Glow Wallet·72
- □KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarusorganizationalso inKelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges·0Lazarus Group Mach-O Man macOS Campaign — 2026·0Mach-O Man Malware Campaign (Lazarus / Chollima)·0H1 2026 Bridge Hack Cluster — Same-Day $35.6M Attack Wave July 22-23·0June 2026 Cross-Chain Bridge Exploit ($127M)·0Lazarus Group Mach-O Man ClickFix macOS Campaign·0Q2 2026 DeFi Record Hack Wave·0Q2 2026 Record Crypto Hack Wave·0DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)·0DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign·0TraderTraitor / UNC4899·0North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign·0Q2 2026 Bridge Exploit Wave·0H1 2026 Crypto Project Shutdown Wave (100+ Projects)·7June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·10AlphaPo·10KelpDAO Bridge Exploit (April 2026)·18Alephium Bridge·18MAP Protocol·18Echo Protocol·20Syscoin Bridge·22Adshares Bridge (ADS)·28SBI Crypto·28CrossCurve Bridge·28Stake.com·28Thorchain DEX·28The Sandbox (SAND)·30LayerZero Labs·32LayerZero — DVN Single-Verifier Configuration Risk·32The Sandbox (SAND OFT Exploit)·34Volo Protocol·37Kipseli·38Curve LlamaLend·52Arbitrum·52Drift Protocol·52THORChain·52LayerZero Protocol·55Euler Finance·58Mantle·60Aave·74
- □Cardanoorganizationalso inH2 2026 July Bridge Hack Wave — Seven Attacks, $M+ Lost·0Rust Crypto Clipper Malware — Fake GitHub Stars Campaign·0Jonathan Spalletta·2Input Output Group (IOG) YouTube Channel Hijack – Deepfake Hoskinson Giveaway Scam·5Wanchain-Cardano Bridge NIGHT Token Exploit (July 2026)·8Phemex·10SecondFi (Cardano Wallet)·13ForceBridge·20Hunter Biden ($LAPTOP token)·22zombies·25Wanchain·32TapTools·38Midnight·39Midnight Network / NIGHT Token·42Midnight (NIGHT Token)·44Zapper·47Robinhood Crypto·54Polygon·54Polkadot (DOT)·54Cardano·72
- □Trust Walletorganizationalso inApple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)·0CastleLoader / NeedleStealer Crypto Wallet Malware Campaign·0fake Ledger Live app·0EVM Cross-Chain Wallet-Drain Campaign (June 2026)·0Fake Sparrow Wallet (Apple App Store)·0OpenClaw GitHub Phishing Campaign·0Sector Drainer — DaaS Wallet Drainer with Phantom 0-Day Bypass·0Solidity Pro VSCode Extension (Malicious)·0Shai-Hulud / TeamPCP Supply Chain Attack·0Quark Drainer·0requests-secure-v2·0Socket Security Malicious Browser Extension Campaign August 2026·2OpenClaw GitHub Phishing Campaign·2Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)·18Trust Wallet Chrome Extension Hack (December 2025)·28Venus Core Pool·28United Stables (U)·33Trust Wallet·55Glow Wallet·72
- ⌂SecondFi (Cardano Wallet)protocol
- □Ctrl Wallet — Security Exploit and Forced Shutdownorganization
Timeline(13 events)
17 July 2024
XDEFI Wallet publicly rebrands to Ctrl Wallet, announcing enhanced multichain features and new user onboarding focus.
Crypto Daily17 October 2024
Ctrl Wallet initiates $XDEFI to $CTRL token migration at a 1:1 ratio, with the $XDEFI token scheduled to deprecate September 25, 2025.
The Defiant29 April 2026
EMURGO, commercial arm of Cardano, acquires Ctrl Wallet's technology infrastructure. The $CTRL token is explicitly excluded from the deal. EMURGO simultaneously rebrands Yoroi Wallet to SecondFi.
CoinTrust21 June 2026
First wave of coordinated attacks begins against SecondFi Cardano wallets, exploiting a cryptographic signing flaw to reconstruct private keys from public transaction data.
SecondFi Knowledge Base (official)22 June 2026
SecondFi detects the breach and activates emergency response protocols. Platform placed in maintenance mode.
SecondFi Knowledge Base (official)23 June 2026
Ctrl Wallet publicly discloses a security vulnerability affecting Cardano-linked wallets. Additional attack waves continue. Total theft reaches approximately 16.1 million ADA across 374 addresses.
Crypto.News24 June 2026
CoinDesk reports the exploit publicly. SecondFi team states approximately 129 million ADA has been secured via emergency containment and transferred to an independent third-party custodian. SlowMist estimates total exposure could have exceeded $20 million.
CoinDesk25 June 2026
Root cause of the cryptographic signing flaw identified and patched in the developer codebase. Final balance snapshot captured on June 26.
SecondFi Knowledge Base (official)9 July 2026
Ctrl Wallet announces permanent shutdown effective August 3, 2026. New downloads halted immediately. App removal from stores begins.
CoinTelegraph22 July 2026
SecondFi publicly details the cryptographic flaw. Groom Lake's forensic report cites two distinct attackers; Attacker A flagged with possible DPRK/Lazarus Group indicators. SecondFi and Yoroi Wallet announce permanent shutdown.
CoinDesk27 July 2026
SecondFi and EMURGO publish compensation plan developed alongside Input Output Group and the Cardano Foundation, centered on a zero-knowledge proof recovery portal.
Cryptonomist3 August 2026
Ctrl Wallet permanently ceases operations. All transfer, swap, and dApp functions disabled. Recovery phrase export functionality retained temporarily. App fully removed from Apple App Store, Google Play, and browser extension stores.
Crypto.NewsDecision Log
- hash: 2RbJpYGnZdgh7JwqN7xM7yx8MtA45gEZzhffsGpemQTD
- hash: A2bzE2o2pcRT8kc3MJgNB6r2VXJZHxSYriqgUJAGSq3X
- hash: UJ4UHXqWCrXoL2uRPdsmD1jp29peNtUZ49prfQgjYp5
This investigation is cryptographically anchored to the Solana blockchain (3 events). 23 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/4/2026, 11:23:31 PM
last updated: 9/11/2026, 1:34:54 AM
4 viewsavoid.net — verified advice for a post-truth world