August 15, 2026. A date that will be etched in the ledger of failed wallet projects.
Cyber, the team behind the CyberWallet and Cyber Passkey Wallet, has announced the shutdown of their frontend interfaces. By midnight, the user-friendly portals vanish. The assets remain on-chain. The recovery path? A raw smart contract interaction with zero support. This is not a hack. It is a controlled exit designed by the team. And it is a textbook case of how account abstraction wallets can become traps for the unwary.
I have seen this pattern before. In 2017, I spent four months dissecting Solidity bytecode of ICOs. I found a project called EtherGate that had merely forked Geth and renamed variables. The code was technically sound, but the marketing was a lie. The same principle applies here: the code is immutable, but the user experience is a fragile layer that can be removed at any time. The ledger remembers what the promoters forgot.
Context: The Cyber Ecosystem Shrinks
CyberWallet and Cyber Passkey Wallet were part of the Cyber ecosystem, a Layer-2 and account abstraction suite. They offered smart contract wallets with features like Social Recovery, Passkey login, and SmartGas—a prepaid gas deposit mechanism. The idea was to bring mainstream users to self-custody via biometrics. But the reality is harsher. The company announced that as of August 15, the frontend would be disabled. Users must withdraw to a signer wallet (CyberWallet) or to an external EOA (Cyber Passkey Wallet) before the deadline. After that, the only way to access funds is through direct smart contract interaction. No documentation. No support. Just a hash and a prayer.
Core: A Systematic Teardown of the Exit Path
Let me walk you through the technical flaws I have identified from the announcement and my own experience auditing smart contract wallets.
1. Exit path opacity. The two wallets have different withdrawal endpoints. CyberWallet requires a transfer to a signer wallet. Cyber Passkey Wallet requires a direct transfer to an external EOA. Why the difference? The signer wallet is likely a proxy for the user's authority. In the Passkey wallet, the passkey (WebAuthn) is the sole signing authority. But here is the catch: if the passkey verification service is run by Cyber, once the frontend goes down, the verification infrastructure may also shut down. The user then has a passkey that cannot generate a valid transaction signature. The ledger remembers what the promoters forgot.
2. The user technical barrier is insurmountable for 99% of users. “Directly interact with the underlying smart contract” means you need to know the contract address, the ABI, the correct function signature, and how to craft a transaction with the correct parameters. You must also handle network fees, gas estimation, and potential timeouts. No support will be provided. I have seen this in the DeFi composability trap of 2020 when I simulated impermanent loss scenarios for Curve. Users thought they could just withdraw, but they needed to understand the slippage math. Here, it is worse: they need to be a developer. Every rug pull leaves a trail of gas fees. This one leaves a trail of unanswered support tickets.
3. SmartGas: The hidden asset that became a voucher. SmartGas is a prepaid gas deposit stored in the contract. It cannot be withdrawn as tokens. Instead, eligible users get Surf vouchers. This is a liquidity discount event. The user’s ETH or gas token is now a coupon for a different service. The coupon’s liquidity, expiry, and terms are undisclosed. I have seen this before in the OpusArt incident where provenance was a lie. Here, the asset is not a lie, but the compensation is a downgrade. The team is effectively paying users with a non-standard instrument. Silence in the code is louder than the contract.
4. No recovery testing or audit. The announcement does not mention any audit of the recovery process. No testnet. No step-by-step guide. No contract address. This suggests that the recovery path is theoretical. In my experience reverse-engineering the AutoTrade AI ZK-circuit, I found that untested exit paths are often the source of critical bugs. If the recovery function reverts due to a gas issue or a modifier check, the user's funds are stuck forever. The team is not liable because they said “no support.”
5. The passkey trap. Passkey wallets rely on WebAuthn, which is a web standard. But the verification of the signature often involves a server that maps the passkey to the user’s account. If Cyber shuts down that server, the user cannot generate a valid signature. The passkey becomes a useless file. The bulls will argue that the private key is on the device. But the signature scheme may require a nonce or a challenge from the server. In that case, the wallet is not truly self-custodial. It is a hosted wallet with a passkey facade.
Contrarian: What the bulls got right
Let me be fair. The bulls will say: “The assets are still on-chain. The smart contract is immutable. Any user with technical ability can recover their funds. This is not a loss of funds, but a loss of convenience.” They are not wrong. The technology of account abstraction is sound. The concept of passkey wallets is innovative. The team did not steal the money. They are giving a grace period. The vouchers are a form of compensation.
But this misses the point. The burden of proof has shifted from the team to the user. The user is not a developer. The user expected a wallet that works like a bank app. When the bank closes, you get your money at the counter. Here, the counter is closed. You have to dig through the vault yourself. The structural flaw is not in the code, but in the lifecycle management of the product. The team built a product that depends on a frontend. When the frontend goes, the user is left with a key that might not fit the lock.
Takeaway: The accountability call
The next time you deposit into a smart contract wallet, ask one question: “What happens when the frontend goes dark?” If the answer is not a one-click migration to another wallet, do not deposit. The crypto industry is full of projects that treat user funds as a liability on their balance sheet. Smart contract wallets are not banks. They are tools. But tools require maintenance. When the maintenance stops, the tool becomes a trap.
I have been doing this for 28 years. I have seen ICOs, DeFi summer, NFT mania, and now the AI-agent boom. The pattern is always the same: the code is not the problem. The incentives are. The team behind CyberWallet is not malicious. They are just moving on. But the cost of moving on is borne by the users. The ledger remembers what the promoters forgot. Every rug pull leaves a trail of gas fees. And silence in the code is louder than the contract.
Final thought: The clock is ticking. If you are a CyberWallet user, move your assets now. If you are a developer, learn from this. Build exit paths that are as user-friendly as the entry paths. Otherwise, you are building a trap.
