September 19, 2026

D'CENT App Wallet: 1,552 wallets emptied in 2 hours. Seed phrases are now considered compromised

September 15, 16:29 UTC. A script starts draining users of the D'CENT App Wallet — the software companion to the Korean hardware wallet. Wave one stumbles: 72 failures, the script mis-computes the XRPL trust-line reserve. While it's being fixed, the 12 fattest wallets (42,000+ XRP each) are emptied by hand, one transfer every 10–30 seconds. At 17:17 the fixed script is back and clears another 1,336 wallets in just over an hour — ≈17 accounts per minute. 18:34 — done.

XRPL total: 2,009,321 XRP (≈$2.8M). Estimated loss across all chains (BTC, ETH, TRON, EVM): ≈$6.6M (SlowMist).

Three things that matter more than the number:

• The victim list was ready in advance. Wallets were processed by creation date (correlation 0.65), not by balance (0.09). Most were created in 2021–2023. That's not brute force — that's leaked app data.
• The hardware wallet didn't help. D'CENT says it plainly: if a hardware-wallet recovery phrase was ever typed into the App Wallet below version 8.1.0, treat it as compromised. Android and iOS. Chains: BTC, ETH, XRPL, TRON, all EVM, USDT ERC20/TRC20, NFTs, staked assets, approvals.
• 90% of the loot is still sitting there. By Sep 17 only ≈236,000 XRP had reached exchanges and bridges (Binance from 20:18 UTC, the Bridgers bridge — 118,400 XRP in 10 transactions). 1.8M XRP remain in attacker addresses. The laundering hub had already processed 1.36M XRP before this — a pipeline, not a one-off. D'CENT has asked exchanges to freeze suspicious deposits.

If you use the D'CENT App Wallet:

• update the app only from the App Store / Google Play;
• create a wallet with a NEW recovery phrase;
• move everything: coins, tokens, NFTs, unstake, revoke approvals;
• never reuse the old addresses.

And one thing for everyone else. Freezes have started, and the cash-out runs through fresh disposable wallets. If you received XRP or USDT from an unknown address this week, don't rush it to an exchange. Screen the sender first: a deposit linked to the attack cluster gets frozen — and you're the one who has to explain where it came from.

Check an address → https://t.me/amlconsensus_bot?start=en (first check is free)

Sources: D'CENT incident report Sep 16, 2026; XRP Forensics / TheCryptoBasic trace Sep 17; SlowMist.