On 16 September 2026 D’CENT published an urgent notice and a status report: abnormal asset transfers were showing up in the DCENT App Wallet, the company’s software wallet. The firm said it had not confirmed an impact on hardware wallets as a class. The exception is the one that matters. If a recovery phrase was created in the app, typed into the app, or restored from a hardware wallet into the app, the app and the device are the same keys. D’CENT told people to update through an official store, create a wallet from a new recovery phrase, and stop using the old one.
The drain did not stop on the day of the notice. By 25 September, ledger tallies reported with the incident put the XRP piece at 12,402,589 XRP taken from 7,393 XRP Ledger wallets, with sweeps still landing after users had been told to move. About 6.3 million of that XRP had been swapped toward Ethereum through THORChain. Activity also showed up on Bitcoin, Ethereum, Tron, and Stellar. Earlier counts, including one dated 15 September, were smaller. Figures moved because the same keys kept working. We are using D’CENT’s 16 September disclosure as the date, and the later public tallies as a running loss, not as a single courtroom number.
What happened
This is a software-wallet story. A recovery phrase in an app is a secret sitting in an application on a phone or a computer, with whatever signing flaw, update gap, or backup path that app had. D’CENT’s own FAQ, updated the afternoon of the disclosure in Korea time, splits the world in two. Hardware wallets whose phrase has never been entered into the App Wallet: no action required on the basis of this incident, and keep watching. Everything else that shares the phrase: treat it as exposed, including a hardware wallet you later initialised from an app phrase, and including an app wallet you only used to receive if you ever signed, approved a token, or connected a dApp. Receive-only addresses were described as lower risk, not as safe.
The company’s instructions are ordinary and correct. Confirm you still have the words, offline. Update from the real store, not a link in a reply. Make a new phrase. Send a small test. Move the rest. Do not restore the old phrase into the new wallet, on the app or on a device. Reusing it regenerates the same keys. Do not send a fresh deposit to an address that was derived from the old phrase. D’CENT said it had asked exchanges to freeze suspect funds, notified partners, and reported the matter to Korean law enforcement. That is a company response. It does not put coins back.
Do not mash this into the Trezor parcel leak or the 2020 Ledger shop dump. Those were names and addresses from a vendor. This is keys, or enough of the signing path to spend them. Do not mash it into a sidechain bug. Liquid and Nomic printed vouchers. Here the voucher is the user’s own backup, typed into software. See how crypto wallets actually work. A wallet is not a place the coins live. The network holds the coins. The phrase is the proof you may move them. An app and a metal device that share a phrase are one wallet with two doors.
Why it matters
Hardware wallets are a practice, not a shopping list, and the practice includes where the words have been. A biometric gadget in a drawer does not help if the same twelve or twenty-four words were restored into a phone app that later failed. The reverse is also true: a hardware wallet that has never seen that phrase is a different key. Marketing that says “our hardware was not hacked” can be true and still miss the customer who typed the backup into the companion app.
Phishing will now wear D’CENT’s name. Nobody legitimate needs the old phrase “to migrate you”, a photo of the card, or a QR that claims to be support. See a practical checklist for keeping crypto safer. If a message hurries you, it is not the status page.
What happens next
More sweeps of people who have not moved, arguments about the exact bug in older app builds, and exchange freezes that will be partial. Watch D’CENT’s own notice and FAQ, not a reply guy. We will not turn a software wallet incident into a reason to abandon hardware devices, or into a reason to trust every app that sits next to one.
Not a review of D’CENT. Not an instruction to buy, sell, or bridge XRP. If your phrase was in the App Wallet, moving to a new phrase is hygiene, not a trade.
