{
 "slug": "dcent-app-wallet-seed-compromise-sep-2026",
 "title": "D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron",
 "url": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026",
 "json": "https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026.json",
 "status": "live",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum",
  "tron",
  "bitcoin"
 ],
 "method": "key-leak",
 "product": "D'CENT mobile App Wallet users (wallets created in the app)",
 "tags": [
  "ethereum",
  "tron",
  "bitcoin",
  "key-leak",
  "dcent",
  "iotrust",
  "mobile-wallet",
  "seed-phrase",
  "xrp",
  "thorchain"
 ],
 "amountUsd": 18000000,
 "victims": 6678,
 "startedAt": "2026-09-15",
 "closedAt": null,
 "updatedAt": "2026-09-28T12:00:00Z",
 "summary": "From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything.",
 "timeline": [
  {
   "date": "2026-09-15",
   "title": "The first of at least six drain waves (through 20 September) hit D'CENT app wallets, taking about 11.7M XRP from 6,678 wallets per xrpl.to.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/"
  },
  {
   "date": "2026-09-17",
   "title": "D'CENT's status report said its latest app includes a check to show users whether they need to act.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/"
  },
  {
   "date": "2026-09-21",
   "title": "Drains continued, with 640,370 more XRP taken after 21 September.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/"
  },
  {
   "date": "2026-09-28",
   "title": "Protos reported more than 7,000 wallets drained, over $18M stolen and 6.3M XRP moved to Ethereum via THORChain, with no recoveries.",
   "sourceUrl": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "The year's second-largest XRP hack is spilling over to Bitcoin and Ethereum",
   "url": "https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/",
   "publisher": "Protos",
   "date": "2026-09-28"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you created a wallet (recovery phrase) inside the D'CENT mobile app, or imported a D'CENT-made phrase into another wallet, assume it is exposed on every chain it covers, not only XRP.\n\n## What to do now\n- Update the app and run its built-in check.\n- Create a brand-new recovery phrase in a trusted wallet (not one made by the D'CENT app) and move all assets, including tokens, NFTs and staked positions.\n- Move quickly: drains have come in waves, from the largest balances down.\n\n## How to avoid this\n- Generate seeds on a hardware wallet or a widely audited wallet, and don't reuse one phrase across apps.\n- Follow your wallet maker's security notices and migrate at once when they say generated keys are at risk.",
 "notes": null,
 "agentBrief": "# D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron\n\n- Severity: Critical · Status: Still active (live)\n- Chains: Ethereum, Tron, Bitcoin · Method: Leaked private keys and seed phrases\n- Started: Sep 15, 2026 · Last update: Sep 28, 2026 · Reported stolen: $18M · Victims: 6678\n- Who/what: D'CENT mobile App Wallet users (wallets created in the app)\n\nFrom 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything.\n\n## Am I affected?\nIf you created a wallet (recovery phrase) inside the D'CENT mobile app, or imported a D'CENT-made phrase into another wallet, assume it is exposed on every chain it covers, not only XRP.\n\n## What to do now\n- Update the app and run its built-in check.\n- Create a brand-new recovery phrase in a trusted wallet (not one made by the D'CENT app) and move all assets, including tokens, NFTs and staked positions.\n- Move quickly: drains have come in waves, from the largest balances down.\n\n## How to avoid this\n- Generate seeds on a hardware wallet or a widely audited wallet, and don't reuse one phrase across apps.\n- Follow your wallet maker's security notices and migrate at once when they say generated keys are at risk.\n\n## Sources\n- The year's second-largest XRP hack is spilling over to Bitcoin and Ethereum (Protos, 2026-09-28): https://protos.com/the-years-second-largest-xrp-hack-is-spilling-over-to-bitcoin-and-ethereum/\n\nFull record: https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026 · JSON: https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}