🧵 FOLLOW-UP: How this drain actually happened (on-chain trace + root cause)
Dug into the two tx's from the alert above. Here's the full trail:
XRP LEDGER
Victim wallet has been active 5+ yrs (funded via Bitstamp back in 2020) not a fresh scam account, a real long-held wallet.
• 03:36:51 UTC: 72,521.28957 XRP ($117.3K) sent out in one shot, account emptied to $1
• Receiving address didn't sit on it 6 hrs later forwarded 40,000 XRP to a 3rd address, which is now also drained to $1
→ classic multi-hop layering, not a one-and-done theft
STELLAR
• 03:38:03 UTC just 72 SECONDS after the XRP drain a create_account sweep moved 17,244 XLM$3.7K) to a freshly created account, signed by the account's own keys
Same signer, two chains, 72 seconds apart = one compromised seed controlling both wallets. That's the signature of a seed that lived in software capable of touching both XRPL and Stellar.
ROOT CAUSE — what D'CENT has confirmed vs. what's still speculation:
✓ Confirmed: only affects phrases entered into the App Wallet (phone software), signed on app versions before 8.1.0 (Nov 5, 2025)
✓ Confirmed: hardware wallet secure element NOT implicated risk is 100% about phrases that touched the phone app
✗ NOT yet confirmed: the exact technical exploit. D'CENT says it's still under investigation.
⚠️ Floating in security circles (unconfirmed): a theory that background malware on Android can pull a seed phrase out of an app's memory within seconds of entry plausible, but NOT something D'CENT has confirmed as the cause here.
Scale estimates have grown as trackers dig further from 1,500 wallets/$2.5M in the first reports to newer estimates near 6,000+ wallets and $9M+. None of these totals are officially confirmed by D'CENT yet, so treat them as developing.
Bottom line: if your seed ever touched the D'CENT App Wallet on a pre-8.1.0 build, the hardware label doesn't protect you. Move funds to a freshly generated seed now.
🚨 COMMUNITY ALERT:
@DCENTWALLETS App Wallet drains are still happening
A member of our community just lost $100k+ in XRP and XLM from a wallet whose seed was ever entered into the D'CENT App Wallet. On-chain proof below.
XLM drain (create_account sweep, 17,244 XLM $3.7K):
stellar.expert/explorer/publ…
XRP drain (bulk of the loss):
bithomp.com/tx/C05D75AE051D2…
Context: D'CENT (maker: IoTrust) confirmed on Sep 16 it detected abnormal App Wallet transfers and told users to move funds off any wallet whose seed touched the App Wallet hardware wallets not implicated so far. D'CENT supports both XRPL and Stellar, so a single compromised seed can drain both.
Reported loss totals have grown since (various outlets, not all independently confirmed) if your seed ever touched the D'CENT App Wallet, assume it's burned and migrate to a brand-new seed on a different wallet NOW.
Tagging
@DOJFraudDiv this needs law enforcement eyes.