Ctrl Wallet to shut down app after June security exploit

Ctrl Wallet will stop operating its wallet app and remove it from app and browser extension stores after a security issue on June 23, 2026. The company told users to withdraw assets or export recovery phrases by Aug. 3, 2026.

From Aug. 3, 2026, sending, receiving, swapping and all other in-app actions will be disabled. Downloads will be halted immediately. Until the deadline users can transfer funds to other wallets or exchanges; after Aug. 3 the only available in-app option will be exporting recovery phrases for import into another wallet.

Users can export 12-word or 24-word recovery phrases and import them into compatible wallets such as MetaMask, Trust Wallet and Phantom. The firm warned there will be no migration token or airdrop and advised users to ignore social posts or websites promising compensation or automated migration.

Ctrl Wallet, formerly XDEFI Wallet, lists between 11 and 50 employees and reports more than 650,000 monthly users. The wallet supported over 2,500 blockchain networks, including Cardano and Midnight. On April 29 the company said its multichain architecture would transition under the Emurgo umbrella and operate inside SecondFi, a self-custodial Cardano platform.

SecondFi experienced a vulnerability on June 24 that allowed attackers to drain an estimated 16 million ADA, then worth about $2.4 million, across 374 addresses. SecondFi reported it secured roughly 129 million ADA through emergency measures and transferred those funds to an independent third-party custodian while verification and recovery continue.

Ctrl Wallet advised exporting recovery phrases directly from the app and completing transfers to trusted wallets or exchanges before Aug. 3 to avoid potential access issues. Users who do not move funds before the shutdown will still be able to import their recovery phrase into other compatible wallets after Aug. 3, but will no longer be able to transact from within the Ctrl Wallet app.