Skip to blog content

    Quality Crypto Reporting · Primary Sources Researched

    CryptoWorkPro

    Market context

    Powered by CoinStats APIUpdated 2:51 AM

    BTC-0.27%
    $84,649
    ETH-1.00%
    $2,681
    XRP-0.45%
    $1.49
    SOL-0.38%
    $118.99
    BNB-0.44%
    $768.72
    HBAR-1.38%
    $0.1011
    QNT+2.65%
    $257.77
    TRX-0.20%
    $0.3337
    LINK-2.58%
    $13.93
    XLM-1.52%
    $0.2155
    Back to Blog
    Wallets & Security

    DCENT Reports Unauthorized Transfers From App Wallet, Investigation Ongoing

    Published September 21, 2026

    Updated Sept. 29, 2026. DCENT's App Wallet investigation remains open. A tracker estimates about 12.4 million XRP. Cause and compensation are unconfirmed.

    DCENT Reports Unauthorized Transfers From App Wallet, Investigation Ongoing

    DCENT says some App Wallet addresses showed unauthorized transfers starting September 16, 2026, and it has published a still-open investigation with a user-action checklist.

    Updated September 29, 2026. DCENT said on September 26 that the investigation and response remain ongoing. Freezing or recovery of assets, it said, depends on authorities and third parties and is not guaranteed. XRPL.to, a ledger tracker, later estimated 12,402,589 XRP across 7,393 XRP Ledger accounts through September 25 at 07:26 UTC. That figure is a tracker estimate, not a confirmed victim count or a complete loss total for all assets. The cause, recovery, and compensation remain unconfirmed. CryptoWorkPro will update this report again as material verified information becomes available.

    The App Wallet is DCENT's software wallet on a phone. A recovery phrase is the 24-word backup that can restore those keys. A hardware wallet is a separate device that generates and stores keys on the device itself. Official company language describes abnormal or unauthorized asset transfers in the App Wallet. DCENT has not confirmed a hack of its hardware wallets, app software, PIN, password, or servers.

    Who, What, When, and Where

    The first customer report arrived early on the morning of September 16, 2026, Korea Standard Time. DCENT posted on X and issued an in-app notice that afternoon. The company dated its incident report September 17, 2026, Korea Standard Time.

    The first irregular transactions were observed on Android. DCENT says the same potential impact exists on iOS. Named networks include Bitcoin, Ethereum, the XRP Ledger, TRON, and other EVM-based chains. ERC-20 and TRC-20 tokens share the same key as the parent chain. An Ethereum-style address may also exist on BSC, Polygon, Base, and Arbitrum.

    What DCENT Has Confirmed

    The September 17, 2026 incident report says investigation is ongoing and withholds the technical root cause. DCENT says it has no indication that the app itself, PIN, or password were compromised or exposed. It says it does not store recovery phrases on servers.

    Potential impact applies, according to DCENT, only if all of the following are true: the recovery phrase was ever entered into App Wallet; the address has signing history such as sends, token or NFT transfers, approvals, or dApp transactions; and signing happened on the app before version 8.1.0, released November 5, 2025. The version at the time of signing matters, not the version currently installed.

    On September 26, 2026, DCENT said the investigation and response efforts were still ongoing. It said it is working with law enforcement, security specialists, blockchain projects, and exchanges to trace assets. Any freeze or recovery, it said, depends entirely on authorities and third parties and cannot be guaranteed.

    What DCENT Says About Hardware Wallets

    On September 26, 2026, DCENT said that, based on information then available and the scope of its investigation to date, it had not identified evidence indicating that the incident originated from DCENT hardware wallets. That is a qualified company statement from an open investigation. It does not establish that every hardware-wallet setup is outside the potential-impact criteria.

    DCENT also said that if a recovery phrase associated with a hardware wallet was ever entered or restored in the App Wallet, users should follow the earlier security guidance. Connecting a hardware wallet to the app only to view balances is not the same as App Wallet mode.

    If the same mnemonic was used in App Wallet and on hardware, or an App Wallet phrase was restored onto hardware, DCENT says to treat the keys as exposed. App Wallet does not support passphrases. If the 24 words were ever entered into App Wallet, a passphrase is not a safeguard.

    Timeline

    On September 16, 2026, the first customer report arrived early in Korea Standard Time. Official X posts and an in-app notice followed that afternoon. DCENT also published FAQ and asset-move guidance that day.

    On September 17, 2026, DCENT published the incident report and a page for checking whether App Wallet action applies. The Korean version of that report prevails if the English translation differs.

    On September 20, 2026, DCENT told App Wallet users to take action. On September 21, it said it did not yet have a confirmed reimbursement outcome it could provide. On September 23 and September 26, it repeated that the investigation continued and that freezing or recovery was not guaranteed.

    Independent Estimates and Press Reports

    XRPL.to published a ledger analysis that it re-derived on September 25, 2026, at 07:26 UTC. It estimated 12,402,589 XRP across 7,393 XRP Ledger wallets or accounts through that snapshot. XRPL.to presents this as its own classification of ledger activity. It is not a DCENT customer count and not a final loss total covering every asset.

    Yonhap News Agency and Financial News reported on September 24, 2026, that IoTrust, DCENT's operator, submitted analysis to the Korea Internet & Security Agency (KISA) and that a possible connection to wallet random-number generation was being examined. CryptoWorkPro did not find a public KISA technical conclusion confirming that hypothesis.

    A September 29, 2026 Daum syndication of ZDNet Korea reported that an IoTrust representative said the company was not yet ready to discuss compensation and had consulted legal counsel. That is a reported position, not a published reimbursement policy.

    SlowMist's Hacked catalog lists a $6,570,000 loss with method Unknown. The catalog date is labeled September 15, while the description cites September 16 and points to DCENT's X post. Treat that dollar figure as SlowMist's catalog estimate, not a DCENT-confirmed total.

    What Remains Unknown

    As of September 29, 2026, CryptoWorkPro did not find a verified public root cause, a final affected-customer count, a final all-assets loss total, a confirmed recovery total, or a compensation plan. DCENT has not released attacker addresses or a technical post-mortem. CryptoWorkPro did not find an independent PeckShield forensic report.

    Watch DCENT's incident report and official X account for further notices. Do not treat social-media loss totals as confirmed until DCENT or a named forensic report publishes them.

    What DCENT Tells Users to Do

    These steps come from DCENT's published notices. They are not a recovery guarantee.

    • Update only through the official Apple App Store or Google Play to version 10.0.0 or later. The iOS app id is 1447206611. The Play Store package is com.kr.iotrust.dcent.wallet.
    • Do not sign from App Wallet before updating.
    • Create a new recovery phrase with Create Wallet, not Restore.
    • Move assets to the new wallet and do not reuse the old address.
    • Do not uninstall before confirming a backup.

    DCENT says being offline does not make an exposed key safe. The company has no official Telegram or Discord. It never asks for a seed phrase, PIN, or a recovery deposit. Official X is @DCENTWALLETS. Support is through Zendesk. DCENT says the Korean version of notices prevails over the English translation.

    Sources

    Disclosure: This article is informational coverage of DCENT's September 2026 App Wallet notices, later official follow-ups, a ledger-tracker estimate, and press reports. The featured image is a generated illustration, not a documentary photograph. The investigation remains open. The technical root cause, final losses, recovery, and compensation are unpublished. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.