South Korean wallet provider D'CENT, operated by IoTrust, is investigating a major security incident involving unauthorized transfers from its mobile App Wallet. The company first flagged abnormal asset transfers on Sept. 16 and published a preliminary incident report the following day. According to D'CENT, users are potentially affected if they entered a recovery phrase into the App Wallet, signed any transaction or approval with it, and used an app version earlier than 8.1.0, released on Nov. 5, 2025.
Blockchain analysis firm XRPL.to traced 11.75 million XRP leaving 6,678 distinct wallets between Sept. 15 and Sept. 20. At XRP's price of about $1.59, the stolen tokens were worth roughly $18.68 million. The draining occurred in six waves, beginning at 15:35 UTC on Sept. 15 and continuing through a final sweep at 20:56 UTC on Sept. 20. The investigator counted 4,208 wallets swept through payment transactions and another 2,470 emptied through account deletion. More than 5.6 million XRP moved through THORChain, while additional funds flowed to unionchain.ai, NEAR Intents, and Binance deposit tags.
D'CENT said its hardware wallets are unaffected unless a device's recovery phrase was also restored into the App Wallet. The company is urging affected users to create a wallet with an entirely new recovery phrase and move all coins, tokens, NFTs, and staked positions. It warned that reusing an existing recovery phrase may regenerate the same or a related key. IoTrust told ZDNet Korea it had received 110 reports by Sept. 18 and has asked Korea's police cyber investigation unit and exchanges to freeze stolen funds. No compensation plan has been announced, and the company says recovery depends on authorities and third parties.
