{"investigation":{"slug":"dcent-wallet","entity_name":"DCENT Wallet","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"DCENT Wallet is a hardware and software cryptocurrency wallet product developed by South Korean cybersecurity firm IoTrust Co., Ltd., founded in 2017 and headquartered in Seoul. On September 16, 2026, IoTrust publicly disclosed that it detected abnormal asset transfers on its DCENT App Wallet and launched an emergency investigation, urging all App Wallet users and any hardware wallet users who shared a mnemonic phrase with the App Wallet to move funds immediately. As of the date of this investigation, no root cause, loss total, or number of affected users has been disclosed, and the incident remains active.","sections":[{"content":"On September 16, 2026, IoTrust — the developer of DCENT Wallet — publicly announced via its official X (formerly Twitter) accounts (@DCENTWALLETS, @DCENTWALLETS_KR, @DCENTWALLETS_JP) that it detected abnormal asset transfers involving its DCENT App Wallet product and had launched an urgent investigation. The company issued an emergency advisory telling all users holding assets in the App Wallet to transfer funds immediately to a hardware wallet or another trusted address. Users who had imported or reused the same mnemonic recovery phrase across both the App Wallet and a DCENT hardware wallet were explicitly identified as also being at risk, because a shared recovery phrase recreates identical private keys and wallet addresses across both products. IoTrust stated that initial findings suggest the issue is limited to the App Wallet and that DCENT hardware wallets (the Biometric Wallet and Card Wallet) are not confirmed to be affected. The company cautioned users against following unofficial recovery instructions, and emphasized that DCENT would never request private keys, recovery phrases, or asset transfers through any channel. As of the date of this scan, IoTrust had not disclosed the technical root cause of the abnormal transfers, the number of users affected, or the total value of assets involved. The investigation was described as ongoing.","heading":"Active Security Incident — September 2026","sources":[{"url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/","name":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","type":"news_article","credibility":2},{"url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/","name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/security/crypto-wallet-maker-dcent-tells-users-to-get-their-coins-out/","name":"Crypto Wallet Maker DCENT Tells Users to Get Their Coins Out — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://en.bloomingbit.io/feed/news/120458","name":"IoTrust Detects Abnormal Transactions in D'CENT App Wallet, Urges Users to Move Assets — Bloomingbit","type":"news_article","credibility":2},{"url":"https://cryptoadventure.com/dcent-urges-app-wallet-users-to-move-funds-as-core-lightning-issues-security-alert/","name":"DCENT Urges App Wallet Users to Move Funds — CryptoAdventure","type":"news_article","credibility":2}],"severity":"critical"},{"content":"As of September 17, 2026, IoTrust had not disclosed the attack vector, the number of wallets affected, or any estimate of funds lost or at risk. The company's public communications were limited to confirming that abnormal transfers were detected, that the App Wallet is the apparent point of compromise, and that further details would be provided once the cause and scope are confirmed. The absence of initial loss figures and root-cause disclosure follows a pattern observed in prior software wallet security incidents, including the Atomic Wallet breach of June 2023 (in which approximately $100 million was reported stolen across more than 5,500 accounts, with root cause disputed for an extended period) and the BitKeep supply-chain attack of December 2022 (in which approximately $9.9 million was stolen via a trojanized APK). In both prior incidents, the delay between initial public acknowledgment and root-cause disclosure complicated users' ability to assess their exposure. It is not possible to determine from currently available public information whether the DCENT incident involves a supply-chain compromise, a client-side vulnerability, a backend server breach, or another attack class. No on-chain analysis from third-party security researchers has been published as of this scan.","heading":"Disclosure Transparency and Information Gaps","sources":[{"url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/","name":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","type":"news_article","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023","name":"Explained: The Atomic Wallet Hack (June 2023) — Halborn","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-bitkeep-hack-december-2022","name":"Explained: The BitKeep Hack (December 2022) — Halborn","type":"research","credibility":2}],"severity":"high"},{"content":"DCENT offers two product lines: a hardware wallet line (the Biometric Wallet and the newer Card Wallet, DCENT S) and a standalone software App Wallet for iOS and Android. IoTrust has stated that its hardware wallets use secure-chip technology (SE and TEE) with key storage physically isolated from internet-connected software. The App Wallet operates as a purely software-based hot wallet. The September 2026 incident is specifically associated with the App Wallet product. However, a material risk factor highlighted in the company's own advisory is that users who imported or derived their hardware wallet's mnemonic phrase into the App Wallet for convenience effectively extended the hardware wallet's key material into a software environment. If the App Wallet's security boundary has been compromised, assets associated with any address derived from a shared mnemonic — regardless of whether those addresses were primarily managed through the hardware device — may be exposed. IoTrust hardware wallets are reported by the company to be unaffected at this time; this claim has not been independently verified as of this scan.","heading":"Hardware Wallet vs. App Wallet Architecture Risk","sources":[{"url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/","name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","credibility":2},{"url":"https://cryptoadventure.com/dcent-urges-app-wallet-users-to-move-funds-as-core-lightning-issues-security-alert/","name":"DCENT Urges App Wallet Users to Move Funds — CryptoAdventure","type":"news_article","credibility":2},{"url":"https://decrypt.co/20032/dcent-biometric-wallet-review-secure-and-simple-but-some-limitations","name":"D'CENT Biometric Wallet Review — Decrypt","type":"news_article","credibility":2}],"severity":"high"},{"content":"DCENT Wallet is developed by IoTrust Co., Ltd., a South Korean cybersecurity company founded in January 2017 and headquartered in Seoul. IoTrust was established by a team of cybersecurity professionals including CEO Sangsu Baek and CSO Minho Yoo, who brought backgrounds in secure systems development, secure-element technology, and embedded security. The company launched the DCENT Biometric Wallet in 2018 — described at the time as the world's first biometrically secured hardware wallet. IoTrust has reported raising approximately 2.5 billion Korean won in early funding from Korea Investment Partners and Jiran Jigyo Security, and subsequently raised approximately 6.5 billion Korean won (roughly $6 million USD) from a second funding round involving L&S Venture Capital, KDB Capital, K-Run Ventures, SL Investment, and KB Investment. The company has reported a user base of more than 700,000 worldwide as of 2026, and has established partnerships with blockchain projects including Klaytn, Flare Network, and others. No regulatory actions by the SEC, CFTC, or other financial regulators have been identified in publicly available sources as of this scan.","heading":"Company Background — IoTrust Co., Ltd.","sources":[{"url":"https://medium.com/dcentwallet/iotrust-the-developer-of-blockchain-wallet-dcent-attracts-investment-of-6-5-8ab1b9a926a8","name":"D'CENT Wallet attracts investment of $6.0M USD — Medium/DCENTWallet","type":"official","credibility":2},{"url":"https://99bitcoins.com/bitcoin-wallet/hardware-wallets/dcent-wallet-review/","name":"D'CENT Wallet Review — 99Bitcoins","type":"research","credibility":2},{"url":"https://www.theblock.co/press-releases/409144/dcent-launches-dcent-s-a-card-format-crypto-hardware-wallet-with-a-dedicated-backup-card","name":"DCENT Launches DCENT S Card-Format Hardware Wallet — The Block","type":"news_article","credibility":2}],"severity":"low"},{"content":"In the wake of the September 2026 incident announcement, IoTrust explicitly warned users to be alert to phishing attempts and fake recovery instructions circulating via unofficial channels. The company emphasized that it would never contact users requesting private keys, recovery phrases, or asset transfers. This warning pattern is consistent with observed behavior following high-profile wallet security incidents, in which threat actors typically launch secondary phishing campaigns targeting affected users. The XRP community on X was specifically noted as having been alerted to the announcement, suggesting DCENT's App Wallet user base includes a material portion of XRP holders who may be targeted by XRP-themed phishing follow-ons.","heading":"Secondary Risk — Phishing and Social Engineering","sources":[{"url":"https://www.tradingview.com/news/u_today:dd4a3a7bd094b:0-xrp-community-on-alert-as-web3-crypto-wallet-reports-security-breach/","name":"XRP Community on Alert as Web3 Crypto Wallet Reports Security Breach — TradingView / U.Today","type":"news_article","credibility":2},{"url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/","name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2017-01-01","event":"IoTrust Co., Ltd. founded in Seoul, South Korea by Sangsu Baek, Minho Yoo, and cybersecurity team.","source":"99Bitcoins D'CENT Wallet Review","source_url":"https://99bitcoins.com/bitcoin-wallet/hardware-wallets/dcent-wallet-review/"},{"date":"2018-01-01","event":"IoTrust launches the D'CENT Biometric Wallet, described as the world's first biometrically secured hardware wallet.","source":"D'CENT Wallet Review — Decrypt","source_url":"https://decrypt.co/20032/dcent-biometric-wallet-review-secure-and-simple-but-some-limitations"},{"date":"2021-01-01","event":"IoTrust raises approximately $6 million USD in a funding round from L&S Venture Capital, KDB Capital, K-Run Ventures, SL Investment, and KB Investment.","source":"D'CENT Wallet attracts investment of $6.0M USD — Medium","source_url":"https://medium.com/dcentwallet/iotrust-the-developer-of-blockchain-wallet-dcent-attracts-investment-of-6-5-8ab1b9a926a8"},{"date":"2026-09-16","event":"IoTrust publicly announces via official X accounts that it detected abnormal asset transfers on the DCENT App Wallet and urges all App Wallet users, and hardware wallet users who shared a mnemonic with the App Wallet, to move funds immediately. Root cause, loss figures, and scope not disclosed. Investigation described as ongoing.","source":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/"}],"sources_used":[{"url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/","name":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","type":"news_article","archive_url":"https://web.archive.org/web/20260917131039/https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/","credibility":2,"archive_timestamp":"2026-09-17T13:10:39+00:00"},{"url":"https://news.bitcoin.com/security/crypto-wallet-maker-dcent-tells-users-to-get-their-coins-out/","name":"Crypto Wallet Maker DCENT Tells Users to Get Their Coins Out — Bitcoin.com News","type":"news_article","archive_url":"https://web.archive.org/web/20260917130557/https://news.bitcoin.com/security/crypto-wallet-maker-dcent-tells-users-to-get-their-coins-out/","credibility":2,"archive_timestamp":"2026-09-17T13:05:57+00:00"},{"url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/","name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","archive_url":"https://web.archive.org/web/20260917125956/https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/","credibility":2,"archive_timestamp":"2026-09-17T12:59:56+00:00"},{"url":"https://en.bloomingbit.io/feed/news/120458","name":"IoTrust Detects Abnormal Transactions in D'CENT App Wallet — Bloomingbit","type":"news_article","archive_url":"https://web.archive.org/web/20260917125908/https://en.bloomingbit.io/feed/news/120458","credibility":2,"archive_timestamp":"2026-09-17T12:59:08+00:00"},{"url":"https://en.cryptonomist.ch/2026/09/16/dcent-wallet-security-issue/","name":"D'CENT Wallet Security Issue Triggers Urgent User Asset Advisories — The Cryptonomist","type":"news_article","archive_url":"https://web.archive.org/web/20260917130225/https://en.cryptonomist.ch/2026/09/16/dcent-wallet-security-issue/","credibility":2,"archive_timestamp":"2026-09-17T13:02:25+00:00"},{"url":"https://cryptoadventure.com/dcent-urges-app-wallet-users-to-move-funds-as-core-lightning-issues-security-alert/","name":"DCENT Urges App Wallet Users to Move Funds — CryptoAdventure","type":"news_article","archive_url":"https://web.archive.org/web/20260917125354/https://cryptoadventure.com/dcent-urges-app-wallet-users-to-move-funds-as-core-lightning-issues-security-alert/","credibility":2,"archive_timestamp":"2026-09-17T12:53:54+00:00"},{"url":"https://www.tradingview.com/news/u_today:dd4a3a7bd094b:0-xrp-community-on-alert-as-web3-crypto-wallet-reports-security-breach/","name":"XRP Community on Alert as Web3 Crypto Wallet Reports Security Breach — TradingView / U.Today","type":"news_article","archive_url":"http://web.archive.org/web/20260917131827/https://www.tradingview.com/news/u_today:dd4a3a7bd094b:0-xrp-community-on-alert-as-web3-crypto-wallet-reports-security-breach/","credibility":2,"archive_timestamp":"2026-09-17T13:18:27+00:00"},{"url":"https://www.okx.com/en-us/orbit/insight/87531227844544","name":"DCENT App Wallet Abnormal Transfer Notice — OKX Orbit","type":"news_article","archive_url":"https://web.archive.org/web/20260917131659/https://www.okx.com/en-us/orbit/insight/87531227844544","credibility":2,"archive_timestamp":"2026-09-17T13:16:59+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023","name":"Explained: The Atomic Wallet Hack (June 2023) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260520141209/https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023","credibility":2,"archive_timestamp":"2026-05-20T14:12:09+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-bitkeep-hack-december-2022","name":"Explained: The BitKeep Hack (December 2022) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260605232021/https://www.halborn.com/blog/post/explained-the-bitkeep-hack-december-2022","credibility":2,"archive_timestamp":"2026-06-05T23:20:21+00:00"},{"url":"https://medium.com/dcentwallet/iotrust-the-developer-of-blockchain-wallet-dcent-attracts-investment-of-6-5-8ab1b9a926a8","name":"D'CENT Wallet attracts investment of $6.0M USD — Medium/DCENTWallet","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/20032/dcent-biometric-wallet-review-secure-and-simple-but-some-limitations","name":"D'CENT Biometric Wallet Review — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260421040246/https://decrypt.co/20032/dcent-biometric-wallet-review-secure-and-simple-but-some-limitations","credibility":2,"archive_timestamp":"2026-04-21T04:02:46+00:00"},{"url":"https://99bitcoins.com/bitcoin-wallet/hardware-wallets/dcent-wallet-review/","name":"D'CENT Wallet Review — 99Bitcoins","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/press-releases/409144/dcent-launches-dcent-s-a-card-format-crypto-hardware-wallet-with-a-dedicated-backup-card","name":"DCENT Launches DCENT S Card-Format Hardware Wallet — The Block","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto-economy.com/crypto-wallet-maker-dcent-tells-users-to-transfer-funds-immediately/","name":"Crypto Wallet Maker DCENT Tells Users to Transfer Funds Immediately — Crypto Economy","type":"news_article","archive_url":"https://web.archive.org/web/20260917125300/https://crypto-economy.com/crypto-wallet-maker-dcent-tells-users-to-transfer-funds-immediately/","credibility":2,"archive_timestamp":"2026-09-17T12:53:00+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-09-17T12:11:59.551206+00:00","updated_at":"2026-09-17T15:40:52.114788+00:00"}}