What caused the App Wallet incident, and what is the current status?
The latest progress takes precedence in the status report. (Last updated 2026-10-07)
For the detailed progress, see the official status report.
1. What happened
In the early hours of September 16, 2026, reports of unauthorized asset transfers were received from some users of the DCENT App Wallet (software wallet). Reports came in across several networks, including XRP. The same day, DCENT convened an incident response team, posted an urgent notice on X and the homepage in the afternoon, and an in-app pop-up in the evening; on September 17 it added a "Check if affected" feature to the app. DCENT has completed reports to KISA and law enforcement, and is working with exchanges, blockchain projects, and security specialists to trace the flow of funds and request freezes.
2. What has been confirmed so far
- The unauthorized asset transfers were identified in the App Wallet (software wallet).
- There is no indication to date that the hardware wallet devices themselves (Biometric, Card, DCENT X) were compromised. However, if a hardware wallet's recovery phrase was ever entered into an App Wallet, it is a target.
- There is no indication to date that the DCENT app itself or its PIN/password was leaked. DCENT does not store recovery phrases, PINs, or passwords on its servers.
- There is no personal-data leak. DCENT does not collect wallet users' personal information.
3. Why the cause has not been disclosed yet
The cause and attack method are being verified together with law enforcement, external security specialists, and related coin projects. Disclosing the specific method before it is confirmed could spread similar attacks, so we will announce it through official channels as it is confirmed. The scale of damage will also be disclosed after analysis that distinguishes it from normal asset transfers made after the urgent notice.
4. The most important thing right now
Don't wait for the cause to be announced — if assets remain in your App Wallet, move them now. Updating the app alone is not enough. The action is complete only when you have moved everything to a wallet created with a new recovery phrase or to a hardware wallet.
Follow-ups are announced through the official blog and X (@DCENTWALLETS).