Ctrl Wallet to shut down August 3 after security exploit

Ctrl Wallet, a multi-chain crypto wallet application that supported more than 2,500 blockchain networks, has told users that it will pull most of its features from the app by August 3, urging them to move their funds before this date. The decision follows a security breach on the wallet last month tied to its Cardano integrations. 

The wallet’s developers chose to decommission the product after the exploits, and as of today, the app cannot be downloaded anymore. The app has disappeared from the Apple App Store, Google Play, and all browser extension marketplaces.

The app remains available to all who had it already installed till August 2. Until this date, transfers, swaps, and dApp connections will continue to work as normal, along with seed-phrase exports.

On August 3, the wallet would go into an export-only state where users will only be able to reveal and export their recovery phrases.

Cardano exploit led to wallet shut down

The closure of the Ctrl wallet is due to a vulnerability that occurred last month on June 23. The company described the exploit as affecting some Cardano-linked hot wallets on the platform and put the service into a temporary maintenance mode while engineers worked on a fix. This fix, however, has proven elusive.

The exploit happened alongside a separate breach in SecondFi, another self-custodial platform built on Cardano by Emurgo, the network’s for-profit arm.

The attackers drained roughly 16 million ADA on June 24, which was worth about $2.4 million at the time. SecondFi later posted a recovery path for affected addresses and claimed that emergency steps moved about 129 million ADA to an independent third-party exchange for verification.

It is worth noting that Ctrl Wallet said on April 29 that it would operate under Emurgo and that its multichain design would continue with SecondFi, itself rebranded from the Yoroi wallet in the same month.

What next for Ctrl wallet users?

Ctrl Wallet has given its users two ways to ensure they keep their crypto. The first is to export the wallet’s 12-word or 24-word recovery phrase and import it into another self-custodial wallet app. The wallet named options like MetaMask, Trust Wallet, and Phantom as compatible.

The other option is pretty straightforward, with Ctrl asking its users to just transfer their funds and NFTs out to a different wallet or a centralized exchange before the August 3 deadline.

Users who have not backed up their recovery phrase or transferred their funds could be locked out of their holdings totally if the installed app later stops working. Ctrl Wallet has said it cannot give a definite timeline on how long the software will remain usable on any given device after the August 3 deadline.

Ctrl Wallet has also left a warning for users, stating that no CTRL token, migration token, airdrop, or compensation program exists, to ignore anyone offering rewards or refunds in exchange for connecting a wallet or handing over a recovery phrase.