D'CENT App Wallet (signing vulnerability) hack — September 2026

An automated drain emptied XRP Ledger wallets belonging to users of D'CENT, a Korean wallet maker operated by IoTrust, in six waves between 15 and 20 September 2026. XRPL.to traced 11.75 million XRP leaving 6,678 distinct wallets, about $16.1m at the prices of the hours in which it moved; CryptoSlate valued the same amount at $18.68m at the XRP price of 23 September, which is kept as the upper end. The first wave, from 15:35 to 18:55 UTC on 15 September, took 3,618,110 XRP from 1,682 wallets. After a quiet 16 September, five more waves between 07:05 on 17 September and 20:56 on 20 September took 7,597,207 XRP from 2,532 more.

From 17 September the operator used the keys a second time. 5,001 AccountDelete transactions closed accounts to collect the reserve each one held, including wallets already emptied, and 2,470 wallets that had never been swept by payment were deleted with whatever they held, 107,507 XRP in one case. The attacker already held the keys and worked from a prepared list rather than scanning in real time: the order in which wallets were drained tracked their creation dates more closely than their balances. The money left the ledger quickly. About 5.6 million XRP went into THORChain with swap memos naming Ethereum addresses, 3.24 million to the exchange unionchain.ai, 546,080 to NEAR Intents and 535,666 to Binance deposit tags, with about 1.31 million still in the operator's wallets at XRPL.to's snapshot.

D'CENT published a preliminary incident report on 17 September describing an App Wallet signing vulnerability, and is withholding the technical details on the grounds that they could be used in identical attacks. It says transactions signed on app versions earlier than 8.1.0, released in November 2025, may have exposed the address, and that the exposure covers Bitcoin, Ethereum, the XRP Ledger, Tron and EVM chains, along with tokens and NFTs sharing those keys. Hardware wallets are affected only where their recovery phrase was entered into the app. Users are told to update, create a new wallet with a new recovery phrase, move everything including staked assets and NFTs, and never reuse the old addresses for anything.

D'CENT says it is working with Korean law enforcement, security specialists, mainnet teams and exchanges to trace the funds and seek freezes, and IoTrust told ZDNet Korea it had received 110 reports by 18 September. On 20 September D'CENT widened its warning, asking the crypto community to help reach App Wallet users who had missed earlier notices. The drains continued after XRPL.to's window: on 23 September one victim lost about 75,000 XRP and 17,244 XLM, the first loss reported on Stellar. Researchers quoted by ZDNet Korea pointed to weak randomness in how older app versions generated keys, which D'CENT has not confirmed. It has not disclosed the technical cause or made any commitment to compensate anyone. Only the XRP Ledger losses have been quantified, so the amount is a floor.