D'CENT Biometric

Documented events with consequences still open. Each entry carries a source and a date.

1. Sep 16, 2026 Hack / funds theft Critical ● open

   Unauthorized transfers from the App Wallet: keys compromised, funds still at risk

   On 16 Sep 2026 IoTrust (D'CENT) disclosed that it had detected unauthorized asset transfers from the D'CENT App Wallet, the in-app software wallet, and urged users to move their funds immediately. The official 17 Sep report lists the exposure criteria: a recovery phrase entered or restored into the App Wallet, an address with signing history (sends, token approvals, dApp transactions), and signing performed on an app version below 8.1.0 (released 5 Nov 2025), across Bitcoin, Ethereum, XRPL, TRON, EVM networks and others. The first unauthorized transactions were observed on Android, but D'CENT states the same exposure applies to iOS. The company has NOT published the technical root cause ("it could be used in identical or similar attacks") nor a total loss figure. Third-party on-chain analyses, unconfirmed by the company, size the XRPL leg alone: an automated sweep of 1,552 accounts for 2,009,321 XRP between 16:29 and 18:34 UTC on 15 Sep, and a later estimate by the XRPL intel account of roughly 6,160 addresses involved for about 9.3 million XRP in total, of which 2 million are still in monitored wallets and 7 million have been moved to unknown destinations (reported on 20 Sep by a single outlet, unconfirmed by the company and not consistent with the 2,009,321 XRP reconstructed on-chain: read it as an estimate, not as the total damage; and it is denominated in XRP, not dollars). Korean law enforcement has taken on the case; D'CENT is tracing funds with an external security firm and asking exchanges and projects to freeze them. ⚠️ Hardware wallets connected to the app are NOT affected — the key never leaves the device — BUT if a hardware wallet's recovery phrase was ever entered or restored into the App Wallet, the same risk applies. As of 21 Sep the company is still publicly asking people to spread the warning to "prevent further damage": exposed keys stay compromised until the funds are moved. Update of 24 Sep: a later reconstruction by the analytics platform XRPL.to, picked up by the trade press, puts the XRPL leg alone at roughly 11.75 million XRP taken from 6,678 accounts across six separate waves between 15 and 20 September — around 18.7 million dollars at the rate used by the source (1.59 $ per XRP). It is the broadest estimate so far and supersedes the earlier ones, but it remains a third-party reconstruction: the company has not confirmed it, has published no total of its own, and has announced no reimbursement. Update of 30 Sep — the company has spoken again and the figures have grown. On 26 Sep IoTrust published its first substantive statement since the 17 Sep report (x.com/DCENTWALLETS/status/2103692076219322824, 05:44): it says it has "not identified evidence indicating that the incident originated from DCENT hardware wallets" — the warning still stands for anyone who ever entered or restored a hardware device's recovery phrase into the App Wallet — and that it is cooperating with law enforcement, external security specialists, blockchain projects and exchanges to trace the assets. On reimbursement and recovery the official wording is blunt and should be read literally: "any freezing or recovery of assets depends entirely on the relevant authorities and third parties and cannot be guaranteed." No compensation plan, neither on 26 Sep nor in the official FAQ, which only asks users to update the app to version 10.0.0 or later and repeats that DCENT will never ask anyone to send assets for a "recovery" or a "compensation". On the figures, a broader reconstruction picked up on 28 Sep by Protos and Crypto Briefing puts the XRPL leg alone at roughly 12.4 million XRP taken from 7,393 accounts across a ten-day window, 15 to 25 September — no longer six waves ending on the 20th. It supersedes the earlier estimate (11.7 million from 6,678 accounts between 15 and 20 Sep) and adds the figure that matters most: a further 640,370 XRP was taken AFTER the public appeal of 21 September, that is, after users had been warned. The first wave on 15 Sep emptied 1,682 accounts for 3.6 million XRP in under three hours, starting by hand on the larger balances and then switching to scripts to work down to the smaller ones; 6,095 accounts are recorded as deleted. Of the proceeds, about 6.3 million XRP — just over half — was swapped into ether through THORChain, a cross-chain swap protocol that requires no identification, and routed onward to centralised exchanges including Binance; as of 25 Sep roughly 1.4 million XRP remained on the attacker's addresses. In dollars the sources give between 18 and 20 million at differing rates: the amount is deliberately left undeclared on this card, because those figures cover the XRPL leg only, depend on the rate chosen, and the company has never published a total of its own. And this is no longer an XRPL-only event. The perimeter the company declared covered Bitcoin, Ethereum, XRPL, TRON and EVM networks, and verified losses outside XRPL now exist: IoTrust has disclosed that it received at least 110 reports of abnormal transfers involving non-XRP assets (as of 18 Sep, reported by ZDNet Korea), and the press documents confirmed losses on Bitcoin and at least one case on Stellar. No per-chain breakdown has been published: the size of the damage outside XRPL is quantified by no one, and that is the biggest remaining gap. The technical root cause has not been disclosed, by the company's stated choice; some researchers point to weak randomness in key generation in older app versions, a hypothesis IoTrust has not confirmed. The traced waves now run to 25 September and the exposed keys remain compromised: anyone who has not yet rotated their recovery phrase can be swept at any moment, which is why this incident is still flagged as active.

   ↗ source

verified on Sep 30, 2026