Cabinet
Back to Technology Insights
2026.09.17

Addresses Signed With Old DCENT App Wallet Versions Drained at Scale: 11.75 Million XRP From 6,678 Wallets, and a Key History That No Patch Can Erase

Addresses Signed With Old DCENT App Wallet Versions Drained at Scale: 11.75 Million XRP From 6,678 Wallets, and a Key History That No Patch Can Erase

What happened

DCENT's status report, current as of September 17 KST, says the first report of an unauthorized transfer reached customer support in the early hours of September 16 (Korea time). That afternoon the company issued urgent notices on X and in the app, reported the case to Korean law enforcement, and asked exchanges to help freeze funds. Irregular transactions were first seen on Android, but the company says the same potential impact applies to iOS.

The company currently lists four main criteria:

  • Wallet type: any address whose recovery phrase has at some point been entered into the App Wallet. This includes wallets created in the App Wallet, hardware wallet phrases restored into it, and App Wallet phrases later moved to a hardware device.
  • Signing history: not only coin sends but also token and NFT transfers, token approvals, and transactions made after connecting to a dApp. Receive-only addresses carry comparatively lower risk, but the company says the risk is not excluded.
  • App version: whether the signing happened in a version earlier than 8.1.0, released November 5, 2025. What counts is the version at the time of signing, not the version installed now.
  • Chain: Bitcoin, Ethereum, XRPL, TRON, EVM chains and others.

On-chain, the most detailed picture comes from third-party analyst XRPL.to. The first sweep began at 15:35 UTC on September 15. Another wave started at 07:05 UTC on September 17, after the company's notice, and the last sweep captured occurred at 20:56 UTC on September 20. In total, 11.75 million XRP left 6,678 wallets. Of these, 4,208 were emptied by ordinary payments and 2,470 by AccountDelete with no preceding payment. At about $1.59 per XRP, that is roughly $18.68 million (about ¥2.94 billion). XRPL.to reports that the drain order tracked account creation dates far more closely than balances, and that most victim accounts were created between 2021 and 2023. All of these transactions were validly signed with the accounts' own keys.

Reading the conditions: what the published criteria tell us

DCENT has withheld the technical cause, saying publication could enable identical or similar attacks. Researchers quoted by ZDNet Korea named weak randomness in older versions' key generation as the most likely cause, but the company has not confirmed this. This article does not assert a cause.

The published criteria still say something. They include both "the version at signing time" and "signing history." If the only flaw were in key generation, whether an address had signed would not affect the scope. Including signing history is consistent with suspected exposure during signing, not only at key generation. That is the author's inference, not the company's statement.

What can be said with more confidence is that the impact follows the phrase's history. A hardware wallet user is in scope if that phrase was ever entered into the App Wallet. The company warns that restoring from an existing phrase "may regenerate the same or a related key" and insists on a new phrase. Safety is set not by whether the device is hardware or software, but by where the key material has travelled.

There is precedent. A 2018 build of Trust Wallet's iOS app generated mnemonics from a PRNG seeded with device time. The flaw was catalogued as CVE-2024-23660, and exploitation was observed in 2023. In both cases, keys created under a vulnerable version kept being targeted for years after the fix.

What the drain timeline shows

XRPL.to's timeline says something important about defensive timing. First, the attacker kept draining after the announcement. Waves were seen on the 17th and 20th, after the first wave on the 15th and the company's notice on the 16th. As long as some users have not seen the notice, or have seen it but not yet moved their assets, the attack continues. That is why DCENT asked the wider community on September 20 to reach App Wallet users directly.

Second, the drain order tracked creation date rather than balance. That suggests the attacker may have known in advance which keys were weak and worked through a list. This is an inference from XRPL.to's observation, not an established fact. If it holds, the set of exposed keys was already fixed at the time of the attack, and every hour before a user moves their assets translates directly into losses.

The money also moved fast. According to XRPL.to, as of September 21:

  • about 5.67 million XRP had gone through THORChain;
  • about 3.24 million XRP had gone to unionchain.ai, which it describes as an exchange;
  • about 546,080 XRP had gone to NEAR Intents;
  • about 535,666 XRP had gone to Binance deposit tags.

About 1.31 million XRP remained in wallets linked to the operation. Funds routed through cross-chain swap services add another layer of tracing work.

Pitfalls to watch

First, updating the app is not a fix. An update protects future signatures; it cannot undo exposure of keys already used to sign on old versions. The company itself treats updating only as a precondition before moving assets.

Second, XRPL's AccountDelete. An open XRPL account locks a reserve, but AccountDelete closes the account and forwards the remainder to another address. Even if a payment sweep leaves the reserve behind, whoever holds the key can take that too. In this incident, 2,470 wallets were emptied that way.

Third, the same key is used in many places. ERC-20 and TRC-20 tokens share the native coin's key, and on EVM chains the same address is shared across BSC, Polygon, Base, Arbitrum and others. Seeing no loss on one chain does not protect assets elsewhere under the same key. Token approvals left on an old address are also a drain path for whoever holds the key.

Fourth, secondary scams. After large drains, fake accounts appear posing as "recovery support" or "compensation" and ask for recovery phrases or asset transfers. DCENT states that it will never ask for a recovery phrase, private key or PIN, and will never give a destination address for recovery or compensation. If anyone in your organization used DCENT, circulate this point as well.

[Technical Insights & Actions]

  1. A key's safety is set not by the device that stores it but by every piece of software its material has passed through since generation. Even a hardware wallet inherits a software flaw once its phrase has been entered into that software. [Product teams / Internal wallet owners] This month, build a register of where each operational and test wallet's phrase was generated and which apps and versions it was entered into. Migrate anything ever entered into DCENT App Wallet to a new phrase.
  2. A vulnerability in key material is not resolved by shipping a fixed version. The fix is complete only when affected keys have been identified and rotated. [Wallet / SDK developers] By your next release, design in a way for users to tell which keys were generated or used to sign under which version, plus a guided migration to new keys that includes moving assets and revoking approvals.
  3. Randomness and signing flaws are invisible to functional tests. Faulty signatures still verify, so the flaw surfaces only after an attack. [Wallet / SDK developers / Contract developers] Within the quarter, confirm that your key generation and signing rely on audited libraries, including deterministic nonce schemes, and replace any custom implementations or custom entropy sources.

[Sources]

Note: JPY conversions use USD 1 = JPY 157.23 (Trading Economics, 2026-09-25). The USD value of XRP uses the price at the time of the CryptoSlate article (about $1.59).

This article is a technical commentary based on publicly available information and is not investment advice.

Previous ArticleAvalanche Helicon Goes Live on Mainnet: C-Chain Acceptance and Execution Are Now Decoupled, and `latest` No Longer Means FinalNext Article Circle Opens Arc Public Mainnet: Where a Permissioned L1 With USDC Gas Breaks EVM-Compatibility Assumptions (18 vs 6 Decimals, No WETH)