D'CENT: $16M in XRP Drained From 6,678 Wallets by a Bug Fixed Ten Months Earlier

At 15:35 UTC on 15 September 2026, just after half past midnight in Seoul, someone began emptying XRP accounts belonging to customers of D'CENT, a South Korean wallet maker. The first eight accounts each held more than 99,999 XRP, and they were drained by hand. Then a script took over. Within hours, 1,682 accounts were empty.

A crypto wallet is where people keep digital money, roughly what a brokerage account is to shares, except that there is no broker. Whoever holds the account's secret key owns what is in it. D'CENT, which dropped its apostrophe and became DCENT on 8 September, is made by IoTrust, a Seoul company founded in 2017 by chip-security engineers and run by chief executive Baek Sang-su. It is best known for a fingerprint-locked hardware wallet, a small device that keeps the key away from the internet. The emptied accounts were not on those devices. They lived in the DCENT App Wallet, the phone app, where the key sits on the phone itself.

The thief came back five more times. By 20 September, XRPL.to, an analytics site that tracks the XRP Ledger (the public record of every XRP payment), counted 11,746,198 XRP taken from 6,678 accounts. At CoinGecko's daily prices for the days of the thefts, that was roughly $16 million. At the $1.59 price of 23 September, when CryptoSlate published the count, it was $18.7 million. A later tally reported by Crypto Briefing on 25 September reached about 12.4 million XRP from 7,393 wallets. The security firm SlowMist logged a much lower $6.57 million on its public tracker, and DCENT has published no figure at all. Losses in Bitcoin, Tether, Tron and Stellar are not in any of these totals.

XRP is a digital currency closely tied to the American payments company Ripple, and it has a devoted following in South Korea. About a quarter of the drained accounts had been funded from the Korean exchanges Upbit, Bithumb and Coinone, according to XRPL.to's analysis as reported by the news site Blockhead. DCENT's own website carried a banner that read "Made for XRP holders".

Fixed in November, drained in September

The one thing DCENT has been clear about is who is at risk. In a status report dated 17 September, the company said the danger applies to any address whose recovery phrase was ever typed into the App Wallet and which signed a transaction in an app version older than 8.1.0. A recovery phrase is the list of 12 or 24 words that rebuilds a wallet from scratch: the master key to everything inside. Signing is how a wallet approves a payment, the digital version of signing a cheque. Version 8.1.0 was released on 5 November 2025.

That date is the uncomfortable part. Signatures made on 8.1.0 or later are outside the danger zone, so whatever changed in that release appears to have closed the hole. But DCENT's public announcement of 8.1.0, issued on 10 November 2025, was about managing up to 100 wallets and importing accounts from MetaMask and Phantom. It said nothing about security. DCENT has not said whether it knew the update fixed a flaw. Its warning to move money came on 16 September 2026, hours after the thefts began, ten months after the update.

How it worked

DCENT has refused to publish the technical cause, saying the details could help copycats. The shape of its warning still says a lot. Addresses that had only ever received money were at "comparatively lower" risk. Addresses that had signed anything, including a token approval or a connection to an online service, were at risk. That points away from stolen passwords and towards the signatures themselves.

Every digital signature mixes the secret key with a fresh random number, used once and thrown away. If that number is predictable, or repeats, the maths behind the signature can be run backwards, much like solving two simultaneous equations, and the key falls out. The signatures sit on the public ledger for anyone to read. An attacker who knows how a faulty app picked its numbers can collect signatures and calculate keys at leisure.

Oh Hyun-ok, a professor at Hanyang University, told ZDNet Korea the likeliest suspect was that the old app did not use enough randomness when creating recovery phrases or signing transactions. Hwang Seok-jin of Dongguk University pointed investigators at the same area while saying phishing could not be ruled out. There is a precedent. In August 2013, a flaw in Android's random number generator let thieves pull private keys out of bitcoin signatures made by several wallet apps. DCENT says the first irregular transactions this time were seen on Android, though the same risk applies to iPhones.

The theft looked like someone working through a list. XRPL.to found that accounts were drained in an order that followed when they were created, mostly between 2021 and 2023, far more closely than how much they held. Every transfer carried a valid signature from the account's own key. Nothing in the XRP Ledger itself was broken. The thief simply had the keys.

The XRP Ledger makes every account lock up a small deposit, called a reserve, just to exist. To collect those deposits too, the thief deleted accounts after emptying them: 5,001 deletions in the first six days, according to XRPL.to, including one account opened in 2022 that still held 107,507 XRP.

Where the money went

Speed was the point. XRPL.to traced about 5.59 million XRP through THORChain, a service that swaps one cryptocurrency for another across separate blockchains without asking who the customer is, and on into Ethereum. About 3.24 million XRP went to unionchain.ai, 546,080 to NEAR Intents, another cross-chain swap service, and 535,666 to deposit addresses at Binance, the largest crypto exchange by trading volume. About 1.31 million XRP still sat in wallets linked to the operation on 21 September.

©CMZ chart. Data: XRPL.to

The alarm did not stop the draining. Korean press reports on XRPL.to's data counted 7,597,207 XRP taken from 2,532 accounts after DCENT's warning on 16 September. On 23 September one holder lost 72,521 XRP, then 2,488 more half an hour later, plus 17,244 Stellar lumens: more than $120,000 in total, according to The Crypto Basic. The lumens reached the exchange Changelly within about four hours.

Who pays

IoTrust told ZDNet Korea it had received 110 reports from victims by 18 September and had asked police and exchanges to freeze stolen funds. On 22 September it gave its own analysis to KISA, the Korea Internet and Security Agency, and asked the government body to issue a cyber-threat alert. Its status report says any freezing or recovery depends on authorities and third parties. No compensation has been offered.

On 8 September, a week before the first theft, DCENT celebrated its new name with a blog post saying that across eight years it had had "zero security breaches". It was talking about its hardware. DCENT says the hardware is still unaffected.