Audit log

Every state-changing event for DCENT Wallet: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-17 12:15:45Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 447,792,918

   sig

   5p9qwypWAPfo…jRJcb9focopyexplorer ↗

   hash

   Eqszo88NtpK5…guJB3fU7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (15515 B) ▸

   {"actor":"system:backfill","investigation_id":"07bf35c4-e22a-41d5-9e6e-dc6f4c437029","kind":"publish","page_slug":"dcent-wallet","published_at":"2026-09-17T12:15:45.203Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DCENT Wallet","sections":[{"content":"On September 16, 2026, IoTrust — the developer of DCENT Wallet — publicly announced via its official X (formerly Twitter) accounts (@DCENTWALLETS, @DCENTWALLETS_KR, @DCENTWALLETS_JP) that it detected abnormal asset transfers involving its DCENT App Wallet product and had launched an urgent investigation. The company issued an emergency advisory telling all users holding assets in the App Wallet to transfer funds immediately to a hardware wallet or another trusted address. Users who had imported or reused the same mnemonic recovery phrase across both the App Wallet and a DCENT hardware wallet were explicitly identified as also being at risk, because a shared recovery phrase recreates identical private keys and wallet addresses across both products. IoTrust stated that initial findings suggest the issue is limited to the App Wallet and that DCENT hardware wallets (the Biometric Wallet and Card Wallet) are not confirmed to be affected. The company cautioned users against following unofficial recovery instructions, and emphasized that DCENT would never request private keys, recovery phrases, or asset transfers through any channel. As of the date of this scan, IoTrust had not disclosed the technical root cause of the abnormal transfers, the number of users affected, or the total value of assets involved. The investigation was described as ongoing.","heading":"Active Security Incident — September 2026","severity":"critical","sources":[{"credibility":2,"name":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/"},{"credibility":2,"name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/"},{"credibility":2,"name":"Crypto Wallet Maker DCENT Tells Users to Get Their Coins Out — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/security/crypto-wallet-maker-dcent-tells-users-to-get-their-coins-out/"},{"credibility":2,"name":"IoTrust Detects Abnormal Transactions in D'CENT App Wallet, Urges Users to Move Assets — Bloomingbit","type":"news_article","url":"https://en.bloomingbit.io/feed/news/120458"},{"credibility":2,"name":"DCENT Urges App Wallet Users to Move Funds — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/dcent-urges-app-wallet-users-to-move-funds-as-core-lightning-issues-security-alert/"}]},{"content":"As of September 17, 2026, IoTrust had not disclosed the attack vector, the number of wallets affected, or any estimate of funds lost or at risk. The company's public communications were limited to confirming that abnormal transfers were detected, that the App Wallet is the apparent point of compromise, and that further details would be provided once the cause and scope are confirmed. The absence of initial loss figures and root-cause disclosure follows a pattern observed in prior software wallet security incidents, including the Atomic Wallet breach of June 2023 (in which approximately $100 million was reported stolen across more than 5,500 accounts, with root cause disputed for an extended period) and the BitKeep supply-chain attack of December 2022 (in which approximately $9.9 million was stolen via a trojanized APK). In both prior incidents, the delay between initial public acknowledgment and root-cause disclosure complicated users' ability to assess their exposure. It is not possible to determine from currently available public information whether the DCENT incident involves a supply-chain compromise, a client-side vulnerability, a backend server breach, or another attack class. No on-chain analysis from third-party security researchers has been published as of this scan.","heading":"Disclosure Transparency and Information Gaps","severity":"high","sources":[{"credibility":2,"name":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/"},{"credibility":2,"name":"Explained: The Atomic Wallet Hack (June 2023) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023"},{"credibility":2,"name":"Explained: The BitKeep Hack (December 2022) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-bitkeep-hack-december-2022"}]},{"content":"DCENT offers two product lines: a hardware wallet line (the Biometric Wallet and the newer Card Wallet, DCENT S) and a standalone software App Wallet for iOS and Android. IoTrust has stated that its hardware wallets use secure-chip technology (SE and TEE) with key storage physically isolated from internet-connected software. The App Wallet operates as a purely software-based hot wallet. The September 2026 incident is specifically associated with the App Wallet product. However, a material risk factor highlighted in the company's own advisory is that users who imported or derived their hardware wallet's mnemonic phrase into the App Wallet for convenience effectively extended the hardware wallet's key material into a software environment. If the App Wallet's security boundary has been compromised, assets associated with any address derived from a shared mnemonic — regardless of whether those addresses were primarily managed through the hardware device — may be exposed. IoTrust hardware wallets are reported by the company to be unaffected at this time; this claim has not been independently verified as of this scan.","heading":"Hardware Wallet vs. App Wallet Architecture Risk","severity":"high","sources":[{"credibility":2,"name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/"},{"credibility":2,"name":"DCENT Urges App Wallet Users to Move Funds — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/dcent-urges-app-wallet-users-to-move-funds-as-core-lightning-issues-security-alert/"},{"credibility":2,"name":"D'CENT Biometric Wallet Review — Decrypt","type":"news_article","url":"https://decrypt.co/20032/dcent-biometric-wallet-review-secure-and-simple-but-some-limitations"}]},{"content":"DCENT Wallet is developed by IoTrust Co., Ltd., a South Korean cybersecurity company founded in January 2017 and headquartered in Seoul. IoTrust was established by a team of cybersecurity professionals including CEO Sangsu Baek and CSO Minho Yoo, who brought backgrounds in secure systems development, secure-element technology, and embedded security. The company launched the DCENT Biometric Wallet in 2018 — described at the time as the world's first biometrically secured hardware wallet. IoTrust has reported raising approximately 2.5 billion Korean won in early funding from Korea Investment Partners and Jiran Jigyo Security, and subsequently raised approximately 6.5 billion Korean won (roughly $6 million USD) from a second funding round involving L&S Venture Capital, KDB Capital, K-Run Ventures, SL Investment, and KB Investment. The company has reported a user base of more than 700,000 worldwide as of 2026, and has established partnerships with blockchain projects including Klaytn, Flare Network, and others. No regulatory actions by the SEC, CFTC, or other financial regulators have been identified in publicly available sources as of this scan.","heading":"Company Background — IoTrust Co., Ltd.","severity":"low","sources":[{"credibility":2,"name":"D'CENT Wallet attracts investment of $6.0M USD — Medium/DCENTWallet","type":"official","url":"https://medium.com/dcentwallet/iotrust-the-developer-of-blockchain-wallet-dcent-attracts-investment-of-6-5-8ab1b9a926a8"},{"credibility":2,"name":"D'CENT Wallet Review — 99Bitcoins","type":"research","url":"https://99bitcoins.com/bitcoin-wallet/hardware-wallets/dcent-wallet-review/"},{"credibility":2,"name":"DCENT Launches DCENT S Card-Format Hardware Wallet — The Block","type":"news_article","url":"https://www.theblock.co/press-releases/409144/dcent-launches-dcent-s-a-card-format-crypto-hardware-wallet-with-a-dedicated-backup-card"}]},{"content":"In the wake of the September 2026 incident announcement, IoTrust explicitly warned users to be alert to phishing attempts and fake recovery instructions circulating via unofficial channels. The company emphasized that it would never contact users requesting private keys, recovery phrases, or asset transfers. This warning pattern is consistent with observed behavior following high-profile wallet security incidents, in which threat actors typically launch secondary phishing campaigns targeting affected users. The XRP community on X was specifically noted as having been alerted to the announcement, suggesting DCENT's App Wallet user base includes a material portion of XRP holders who may be targeted by XRP-themed phishing follow-ons.","heading":"Secondary Risk — Phishing and Social Engineering","severity":"medium","sources":[{"credibility":2,"name":"XRP Community on Alert as Web3 Crypto Wallet Reports Security Breach — TradingView / U.Today","type":"news_article","url":"https://www.tradingview.com/news/u_today:dd4a3a7bd094b:0-xrp-community-on-alert-as-web3-crypto-wallet-reports-security-breach/"},{"credibility":2,"name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/"}]}],"sources_used":[{"credibility":2,"name":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/"},{"credibility":2,"name":"Crypto Wallet Maker DCENT Tells Users to Get Their Coins Out — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/security/crypto-wallet-maker-dcent-tells-users-to-get-their-coins-out/"},{"credibility":2,"name":"DCENT Urges Urgent Asset Transfer from App Wallet After Security Breach — CoinTurk","type":"news_article","url":"https://en.coin-turk.com/dcent-urges-urgent-asset-transfer-from-app-wallet-after-security-breach/"},{"credibility":2,"name":"IoTrust Detects Abnormal Transactions in D'CENT App Wallet — Bloomingbit","type":"news_article","url":"https://en.bloomingbit.io/feed/news/120458"},{"credibility":2,"name":"D'CENT Wallet Security Issue Triggers Urgent User Asset Advisories — The Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/16/dcent-wallet-security-issue/"},{"credibility":2,"name":"DCENT Urges App Wallet Users to Move Funds — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/dcent-urges-app-wallet-users-to-move-funds-as-core-lightning-issues-security-alert/"},{"credibility":2,"name":"XRP Community on Alert as Web3 Crypto Wallet Reports Security Breach — TradingView / U.Today","type":"news_article","url":"https://www.tradingview.com/news/u_today:dd4a3a7bd094b:0-xrp-community-on-alert-as-web3-crypto-wallet-reports-security-breach/"},{"credibility":2,"name":"DCENT App Wallet Abnormal Transfer Notice — OKX Orbit","type":"news_article","url":"https://www.okx.com/en-us/orbit/insight/87531227844544"},{"credibility":2,"name":"Explained: The Atomic Wallet Hack (June 2023) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023"},{"credibility":2,"name":"Explained: The BitKeep Hack (December 2022) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-bitkeep-hack-december-2022"},{"credibility":2,"name":"D'CENT Wallet attracts investment of $6.0M USD — Medium/DCENTWallet","type":"official","url":"https://medium.com/dcentwallet/iotrust-the-developer-of-blockchain-wallet-dcent-attracts-investment-of-6-5-8ab1b9a926a8"},{"credibility":2,"name":"D'CENT Biometric Wallet Review — Decrypt","type":"news_article","url":"https://decrypt.co/20032/dcent-biometric-wallet-review-secure-and-simple-but-some-limitations"},{"credibility":2,"name":"D'CENT Wallet Review — 99Bitcoins","type":"research","url":"https://99bitcoins.com/bitcoin-wallet/hardware-wallets/dcent-wallet-review/"},{"credibility":2,"name":"DCENT Launches DCENT S Card-Format Hardware Wallet — The Block","type":"news_article","url":"https://www.theblock.co/press-releases/409144/dcent-launches-dcent-s-a-card-format-crypto-hardware-wallet-with-a-dedicated-backup-card"},{"credibility":2,"name":"Crypto Wallet Maker DCENT Tells Users to Transfer Funds Immediately — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-wallet-maker-dcent-tells-users-to-transfer-funds-immediately/"}],"summary":"DCENT Wallet is a hardware and software cryptocurrency wallet product developed by South Korean cybersecurity firm IoTrust Co., Ltd., founded in 2017 and headquartered in Seoul. On September 16, 2026, IoTrust publicly disclosed that it detected abnormal asset transfers on its DCENT App Wallet and launched an emergency investigation, urging all App Wallet users and any hardware wallet users who shared a mnemonic phrase with the App Wallet to move funds immediately. As of the date of this investigation, no root cause, loss total, or number of affected users has been disclosed, and the incident remains active.","timeline":[{"date":"2017-01-01","event":"IoTrust Co., Ltd. founded in Seoul, South Korea by Sangsu Baek, Minho Yoo, and cybersecurity team.","source":"99Bitcoins D'CENT Wallet Review","source_url":"https://99bitcoins.com/bitcoin-wallet/hardware-wallets/dcent-wallet-review/"},{"date":"2018-01-01","event":"IoTrust launches the D'CENT Biometric Wallet, described as the world's first biometrically secured hardware wallet.","source":"D'CENT Wallet Review — Decrypt","source_url":"https://decrypt.co/20032/dcent-biometric-wallet-review-secure-and-simple-but-some-limitations"},{"date":"2021-01-01","event":"IoTrust raises approximately $6 million USD in a funding round from L&S Venture Capital, KDB Capital, K-Run Ventures, SL Investment, and KB Investment.","source":"D'CENT Wallet attracts investment of $6.0M USD — Medium","source_url":"https://medium.com/dcentwallet/iotrust-the-developer-of-blockchain-wallet-dcent-attracts-investment-of-6-5-8ab1b9a926a8"},{"date":"2026-09-16","event":"IoTrust publicly announces via official X accounts that it detected abnormal asset transfers on the DCENT App Wallet and urges all App Wallet users, and hardware wallet users who shared a mnemonic with the App Wallet, to move funds immediately. Root cause, loss figures, and scope not disclosed. Investigation described as ongoing.","source":"DCENT Warns App Wallet Users After Detecting Abnormal Asset Transfers — Crypto Times","source_url":"https://www.cryptotimes.io/2026/09/16/dcent-warns-app-wallet-users-after-detecting-abnormal-asset-transfers/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b34f5f51-003c-45bf-8bff-d886d057ee7ccopy
2. #2rescoreby systemsystem

   2026-10-27 06:09:52Z
   Score: 28 → 50 (+22)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: concerns that are not fraud −12, incidents the subject suffered −10, problems around the subject, caused by others −1.1; legitimacy credit long-running +10; a recent unresolved incident −11.6.
   anchoranchored

   chain

   ●mainnet-betaslot 461,967,038

   sig

   23bJVB8RfexP…y7JCbq69copyexplorer ↗

   hash

   ChBLZxiM9uVG…8aRk36nWcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (678 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:09:51.994Z","decision":"rescore","investigation_id":"07bf35c4-e22a-41d5-9e6e-dc6f4c437029","new_score":50,"page_slug":"dcent-wallet","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 50. Problems weighed by who is responsible: concerns that are not fraud −12, incidents the subject suffered −10, problems around the subject, caused by others −1.1; legitimacy credit long-running +10; a recent unresolved incident −11.6.","score_delta":22,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8dfe2eee-c585-4063-af42-8179fca691c8copy
3. #3reviewby reviewerreviewer

   2026-10-27 19:20:14Z
   Score: 50 → 50 (no score change)
   The core Sept 16, 2026 announcement, the shared-mnemonic warning and the hardware-wallet statements are confirmed. The page is stale and misleading by omission: it says no loss, scope or on-chain analysis exists, but by Sept 23 reporting showed funds drained, version scope below 8.1.0, third-party tallies and a preliminary company report. The Atomic Wallet and BitKeep figures do not match the cited Halborn pages. Company background claims could not be checked because the sources returned 403.
   anchoranchored

   chain

   ●mainnet-betaslot 462,186,747

   sig

   613MFcX4ebwc…vvt9kyQKcopyexplorer ↗

   hash

   77NQhca8ttBC…XHSU7uaEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1379 B) ▸

   {"actor":"reviewer","artifact_identity":"f01ddc0e340e1036c10d7c7f76d5af25","blocked_count":2,"decided_at":"2026-10-27T19:20:13.969Z","decision":"review","disputed_pct":0,"findings_hash":"B3eRz9o8tBCp69rAJzgMc4NH6BkDwm8nxfhN2PHuU3eY","investigation_id":"07bf35c4-e22a-41d5-9e6e-dc6f4c437029","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":3,"total":4},"page_content_hash":"17c9783cae6c18797d32788eadf035d9eccdc29c70730ff55dbc0c5484fae4fa","page_slug":"dcent-wallet","prev_score":50,"reason":"The core Sept 16, 2026 announcement, the shared-mnemonic warning and the hardware-wallet statements are confirmed. The page is stale and misleading by omission: it says no loss, scope or on-chain analysis exists, but by Sept 23 reporting showed funds drained, version scope below 8.1.0, third-party tallies and a preliminary company report. The Atomic Wallet and BitKeep figures do not match the cited Halborn pages. Company background claims could not be checked because the sources returned 403.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":3,"subject_status":"exploited","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 17ef54e0-c12f-435b-bda9-4ed75e46a3cacopy
4. #4review reviseby judgejudge

   2026-10-27 19:20:14Z
   Score: 50 → 50 (no score change)
   The page's core facts hold: the September 16, 2026 disclosure and the hardware-wallet statements are confirmed (claim_findings[0], [5]). The two claims that the incident has no disclosed scope and that no third-party on-chain analysis exists are stale (claim_findings[1], [2]). Reporting as of September 23, 2026 shows funds were drained, versions before 8.1.0 are in scope, and XRPL.to and XRPL Intel have published analyses, so the page understates an exploit that has happened (subject_status, omission_findings[0] to [2]). The Atomic Wallet and BitKeep figures also do not match the cited Halborn pages (claim_findings[3], [4]). Two company-background claims could not be checked because the sources blocked the reviewer, which is a coverage limit and not a defect of the page. The penalty stays moderate because the reviewer's confidence is 0.6 and the original claims were accurate when written.
   anchoranchored

   chain

   ●mainnet-betaslot 462,186,752

   sig

   5TfEmaHusCBU…ynaJGrNWcopyexplorer ↗

   hash

   BbR4sYuDXX2m…49ij68Fscopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2159 B) ▸

   {"actor":"judge","artifact_identity":"f01ddc0e340e1036c10d7c7f76d5af25","band_override":null,"blocked_count":2,"decided_at":"2026-10-27T19:20:13.969Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"07bf35c4-e22a-41d5-9e6e-dc6f4c437029","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"dcent-wallet","prev_score":50,"reason":"The page's core facts hold: the September 16, 2026 disclosure and the hardware-wallet statements are confirmed (claim_findings[0], [5]). The two claims that the incident has no disclosed scope and that no third-party on-chain analysis exists are stale (claim_findings[1], [2]). Reporting as of September 23, 2026 shows funds were drained, versions before 8.1.0 are in scope, and XRPL.to and XRPL Intel have published analyses, so the page understates an exploit that has happened (subject_status, omission_findings[0] to [2]). The Atomic Wallet and BitKeep figures also do not match the cited Halborn pages (claim_findings[3], [4]). Two company-background claims could not be checked because the sources blocked the reviewer, which is a coverage limit and not a defect of the page. The penalty stays moderate because the reviewer's confidence is 0.6 and the original claims were accurate when written.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"approve","reason":"By claim percentage alone the page sits in the minor band (2 stale of 7 countable findings, about 29%; two source_blocked findings excluded). However, omission_findings[1] is critical and omission_findings[0] and [2] are material, and subject_status.contradicts_page is true: the page says no loss, scope or on-chain analysis exists, while later reporting shows funds drained (about 2.0M XRP from 1,552 wallets) and affected versions below 8.1.0. This is escalated to the significant band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4079c165-20a2-44da-8271-e072b3643437copy