Japanese

Investigation into the DCENT Wallet Unauthorized Transfers and XDC Fund Flows

• Source of the address under investigation: X post by @alwaysbplottn
• Report date: October 11, 2026 (JST)
• Network: XDC Network
• Primary address: 0x64705697bbc905416dd01237ad925b6c52e21dc2
• Status: Ongoing monitoring recommended

[!WARNING]
This report correlates public on-chain data, official statements from DCENT, and third-party technical research. On-chain data alone cannot establish that every sending address belonged to a DCENT user, nor can it conclusively identify the individuals or organizations controlling the addresses. Confirmed facts, strong inferences, and unresolved questions should be distinguished carefully.

Executive Summary

The unauthorized-transfer incident disclosed by DCENT Wallet in September 2026 does not currently appear to be a compromise of the DCENT hardware wallet itself. The available evidence instead points to private-key exposure associated with the signing process in older versions of the smartphone-based App Wallet (software wallet).

DCENT states that an address may be affected when the following conditions apply:

1. Its recovery phrase was entered into the App Wallet at some point.
2. The address was used to sign a transfer, token approval, NFT transfer, DApp transaction, or another operation.
3. The signature was produced with a DCENT app version earlier than v8.1.0.
4. The address was used on Bitcoin, Ethereum, XRPL, TRON, an EVM-compatible network, or another listed network.

Independent reverse-engineering research suggests that an older DCENT App Wallet may have generated the ECDSA signing nonce k using ordinary rand() seeded from the current time rather than a cryptographically secure generator. If so, an attacker could brute-force k from a previously published signature and derive the private key. DCENT has not publicly confirmed these implementation details, so this report treats that explanation as a strong third-party technical finding rather than an official conclusion.

On XDC Network, a large number of simple native-XDC transfers converged on 0x6470...1dc2 over a short period. A complete cursor-based extraction from a fully synchronized XDC Indexer returned 4,694 transactions: 4,685 incoming and nine outgoing, with no duplicate transaction hashes. The incoming transfers originated from 4,681 addresses, and the median interval between them was two seconds. This is consistent with scripted processing of a prepared list of private keys rather than manual transfers. XDCScan's web interface displays 12,329 transactions, but that figure does not reconcile with the complete Indexer scan or the account balance calculation and is therefore not used as the analytical denominator.

The primary address sent a total of 8,231,410 XDC to 0xff5d...c029. After receiving funds, that address generally forwarded approximately matching amounts within three to seven minutes to 0x43b9...dcaa, which XDCScan labels Huobi 1. All 21 outgoing transactions from 0xff5d...c029 went to Huobi 1 and totaled approximately 17,859,046.949 XDC. The most significant observable off-ramp is therefore the flow through 0xff5d...c029 toward HTX, formerly Huobi.

1. What Happened to DCENT Wallet

1.1 App Wallet vs. Hardware Wallet

The DCENT application can manage several wallet types in the same interface.

Wallet type	Private-key storage and signing location	Relationship to this incident
App Wallet	Inside the smartphone	Primary affected product
Biometric Wallet / DCENT X	Hardware secure element	No compromise currently confirmed when used independently
DCENT S	Secure element inside the card	No compromise currently confirmed when used independently

However, if the 24-word phrase from a hardware wallet was entered into the App Wallet—or an App Wallet phrase was restored onto a hardware wallet—the two products share the same underlying private keys. In that situation, the keys are no longer isolated even if the hardware device itself remains secure, and the wallet may fall within the affected scope.

1.2 Suspected Signing Vulnerability

An ECDSA signature uses a per-signature secret value k in addition to the private key d.

s = k⁻¹ × (z + r × d) mod n

The values r, s, z, and n are public or derivable from the signature and transaction. If k becomes known, the private key can be calculated as follows:

d = (s × k − z) × r⁻¹ mod n

According to third-party research, older versions of the DCENT App Wallet may have generated k with a regular 32-bit rand() seeded by the current time. That would leave at most approximately 4.3 billion candidates, with the transaction timestamp narrowing the practical search range further.

Under this attack model, the victim's phone does not need to be online when the theft occurs. Once a private key has been recovered, an attacker can create valid signatures in a separate environment. Updating the app does not change the old private key or previously published signatures, so assets must be moved from the old key to an entirely new key.

1.3 Officially Stated Conditions for Possible Exposure

DCENT's primary conditions can be summarized as follows:

The relevant factor is not the version currently installed, but the version used when the signature was created. DCENT released v8.1.0 on November 5, 2025.

1.4 Known Incident Timeline

2. Primary Address on XDC Network

2.1 Basic Information

Item	Value
Address	0x64705697bbc905416dd01237ad925b6c52e21dc2
Transactions fully retrieved from Indexer	4,694, with no duplicate TX hashes
Incoming transactions	4,685
Outgoing transactions	9
Unique incoming senders	4,681 addresses
XDCScan web display	12,329, inconsistent with Indexer and balance calculation
First activity	2026-10-02 21:59:21 UTC
Last observed incoming transfer	2026-10-10 13:07:48 UTC
Total inflow calculated from Indexer	11,565,752.004172885205624842 XDC
Sent to 0xff5d...c029	8,231,410 XDC
Balance observed on 2026-10-11	3,334,341.999759 XDC

The total inflow calculated from the Indexer also reconciles with the amount derived from the remaining balance:

Total inflow ≈ current balance + nine outgoing transfers + transaction fees
             ≈ 3,334,341.999759 + 8,231,410 + approximately 0.004414
             ≈ 11,565,752.004173 XDC

2.2 Statistics Indicating Automation

All 4,694 transactions were retrieved through the cursor API of a fully synchronized XDC Indexer. The following statistics cover all 4,685 incoming transfers.

Metric	Result
Incoming transfers analyzed	4,685, complete set
Unique sending addresses	4,681
Median interval between incoming transfers	2 seconds
Consecutive transfers no more than one second apart	1,233
Maximum transfers sharing one timestamp	212
Median incoming amount	Approximately 5.498486 XDC
Largest incoming amount	Approximately 801,049.899 XDC

All 4,685 incoming records returned by the Indexer were native-XDC transfers. In a separate initial sample of 1,972 incoming transfers obtained from the XDCScan API, every transaction used 21,000 gas. These were not token-contract calls, approvals, or complex DApp interactions. The pattern is therefore consistent with direct signatures created using each sending address's private key.

2.3 Activity Waves

The complete incoming dataset shows the following waves:

UTC date	Incoming transfers	Total	Characteristic
2026-10-02	2,284	Approximately 7,548,386.939 XDC	Initial large-scale collection
2026-10-03	864	Approximately 183,026.855 XDC	Smaller and residual balances
2026-10-07	1,030	Approximately 12,478.577 XDC	High-volume collection including dust
2026-10-08	475	Approximately 3,801,091.417 XDC	Additional wave including high-value addresses
2026-10-10	32	Approximately 20,768.216 XDC	Last observed wave

At the start of the October 8 wave, balances of approximately 801,050, 789,221, 449,300, and 303,641 XDC were transferred only seconds apart. This may indicate that the operator prioritized a prepared list of compromised keys by account balance.

3. Prior History Shown Under Funded By

3.1 Why Funded By Can Be Misleading

XDCScan lists 0xaa1c...ddc9 under Funded By for 0x6470...1dc2. The label indicates the address that first sent XDC to the target. By itself, it does not establish involvement in the incident or identify an entity financing the activity.

The following diagram presents confirmed on-chain transactions in chronological order. “Bitrue 3” is reproduced exactly as an XDCScan explorer label.

This diagram records transaction history only. It does not indicate that Bitrue or the controllers of any depicted address were involved in the incident.

4. Fund Flow Toward HTX / Huobi

4.1 From the Primary Collector Toward an Exchange Deposit Route

0x6470...1dc2 sent a total of 8,231,410 XDC in nine transfers to:

0xff5d04dc4c07958df0fc3fd5654fa6368a48c029

Within minutes of receiving funds, 0xff5d...c029 forwarded approximately matching amounts to the address labeled Huobi 1 by XDCScan:

0x43b96a1bbe34ccf6d67b334ee86405fb950bdcaa

4.2 Delay Between Receipt and Exchange Sweep

0x6470... → 0xff5d...	0xff5d... → Huobi 1	Delay
500,000 XDC	499,999.999524 XDC	4m28s
1,000,000 XDC	999,999.999855 XDC	3m34s
1,000,000 XDC	999,999.999714 XDC	5m28s
1,000,000 XDC	999,999.999685 XDC	6m31s
800,000 XDC	799,999.999561 XDC	4m30s
1,000,000 XDC	999,999.999855 XDC	3m43s
1,000,000 XDC	999,999.999698 XDC	4m30s
1,431,410 XDC	1,431,409.997424 XDC	3m32s
500,000 XDC	500,000.001307 XDC	3m27s

Some amounts do not match exactly because 0xff5d...c029 received funds from collectors other than the primary address and forwarded from a combined account balance. Native XDC uses an account-based model, so individual units cannot be traced one-for-one as UTXOs can. Nevertheless, the repeated pattern of forwarding approximately matching amounts to the same Huobi-labeled wallet shortly after receipt is clear.

4.3 Address-Role Assessment

Address	Assessed role	Confidence
0x6470...1dc2	Primary collector for suspected victim XDC	Very high
0xff5d...c029	HTX/Huobi deposit or pre-sweep address used by the same or a cooperating operator	High
0x43b9...dcaa	Hot wallet labeled “Huobi 1” by XDCScan	Confirmed as an explorer label
0x1f15...65fe	Intermediate collector combining a small number of upstream addresses	High
0x1f6e...d6959a	Parallel collector combining 66 addresses in rapid succession	Very high

4.4 Verification of the Additional Collectors

Complete transaction histories retrieved from the Indexer show the following behavior:

Metric	0x1f15...65fe	0x1f6e...d6959a
Full address	0x1f15fe8b4fed258b4c08bf97f02f2a31a45465fe	0x1f6e81c24ce690e25cfef0cfc8e7575f58d6959a
External incoming transfers	4 transfers from 3 addresses	66 transfers from 66 addresses
Total external inflow	Approximately 3,593,617.447 XDC	Approximately 6,034,019.515 XDC
Inflow window	2026-10-02 21:42:44-21:45:16 UTC	2026-10-02 21:52:26-21:55:40 UTC
Median incoming interval	6 seconds	2 seconds
Sent to 0xff5d...c029	6 transfers; approximately 3,593,617.445 XDC	6 transfers; approximately 6,034,019.512 XDC
Other external destinations	None	None
Sender overlap with primary collector	None	None

0x1f15...65fe contains one self-transfer of approximately 983,617.445 XDC. Because this was not a net inflow, it is excluded from the table. The approximately 3.59 million XDC received externally was sent to 0xff5d...c029 in six transfers, less an amount consistent with transaction fees.

0x1f6e...d6959a received approximately 6.03 million XDC from 66 different addresses in only three minutes and 14 seconds. This closely resembles the rapid bulk-collection pattern of the primary 0x6470...1dc2 address. It then sent nearly the entire amount to the same 0xff5d...c029 address.

The source addresses for these two collectors do not overlap with those of the primary collector. However, both gathered funds during closely adjacent windows on the same day and used 0xff5d...c029 as their only external destination. They are therefore likely parallel collection routes operated by the same or cooperating actors. On-chain data does not establish that their source addresses belonged to DCENT users, so attribution to the DCENT incident remains unconfirmed.

5. Assessment of the Link to the DCENT Incident

5.1 Factors Supporting a Link

• DCENT's stated exposure scope includes EVM-compatible networks.
• XDC is EVM-compatible and uses secp256k1 signatures.
• Simple native-XDC transfers from thousands of different addresses converged on the same destination.
• Each transfer was directly signed with the sending address's private key.
• Common gas conditions, intervals of only seconds, and transfers approximating entire account balances form a consistent pattern.
• The behavior resembles scripted processing of a prepared private-key list observed in the XRP incident.
• Unauthorized transfers using old keys continued after DCENT's public warning.

5.2 What On-Chain Data Cannot Establish

• Whether every sending address was created or imported in the DCENT App Wallet.
• Whether each address signed a transaction using a version earlier than v8.1.0.
• The identity of the person or organization controlling 0x6470...1dc2.
• The HTX internal account and KYC records associated with 0xff5d...c029.
• Whether the XRP and XDC activity was conducted by the same person or organization.

Conclusive attribution to the DCENT incident requires correlating victim reports, DCENT wallet creation or usage records, app versions at the time of signing, and non-public information held by law enforcement and exchanges.

6. Recommended Response Priorities

6.1 Highest Priority: Freeze and Record-Preservation Request to HTX

Because 0xff5d...c029 appears to have been used as an exchange deposit route and all 21 of its outgoing transactions reached Huobi 1, it would be valuable to provide HTX with:

• Primary collector: 0x64705697bbc905416dd01237ad925b6c52e21dc2
• Suspected HTX deposit-route address: 0xff5d04dc4c07958df0fc3fd5654fa6368a48c029
• Huobi 1: 0x43b96a1bbe34ccf6d67b334ee86405fb950bdcaa
• All 21 transaction hashes from 0xff5d...c029 to Huobi 1
• A request to identify the internal user ID credited by the relevant deposits
• A request to preserve KYC, login IP, device, API-key, withdrawal-destination, and internal-transfer records
• The case or report number issued by DCENT, police, or another investigative authority

The balance of 0xff5d...c029 was nearly zero at the time of this investigation, but the exchange's internal ledger may retain the mapping between the deposit route and an internal account.

6.2 Sharing with DCENT, XDC Organizations, and Law Enforcement

• Provide DCENT Support with the address set and transaction hashes.
• Ask the XDC Foundation and XDCScan to label the addresses as suspected illicit-fund destinations.
• For each victim, record the sending address, transaction hash, amount, discovery time, wallet type, operating system, and app version used when signing.
• Victims in Japan should report the incident to the appropriate police cybercrime consultation service.
• Never send a recovery phrase, private key, or PIN to anyone, including DCENT, an exchange, or law enforcement.

6.3 Ongoing Monitoring

At the time of this investigation, approximately 3,334,341.999759 XDC remained at 0x6470...1dc2. Monitoring should follow this process:

7. Methodology and Limitations

Data Sources

• XDCScan address and transaction pages
• XDCScan Account API
• Fully synchronized XDC Indexer API using complete cursor pagination
• Official XDC JSON-RPC
• Official DCENT incident reports and FAQ
• Independent reverse engineering of the DCENT application
• Independent on-chain aggregation relating to the XRPL incident

Data Notes

• For this address, the XDCScan Account API repeatedly returned a fixed set of 1,980 records and ignored pagination. Complete cursor-based retrieval from the XDC Indexer resolved this limitation.
• XDCScan's web interface displays 12,329 transactions, while a complete scan of the 100%-synchronized Indexer returns 4,694: 4,685 incoming and nine outgoing, with no duplicate transaction hashes. The Indexer inflow and outflow totals reconcile precisely with the current balance and transaction fees. This report therefore uses the Indexer statistics. The cause of the XDCScan display discrepancy remains unresolved.
• Outgoing nonce 1, which was absent from the API result, was supplemented from XDCScan's outgoing-transaction view.
• Native XDC uses an account-based balance model. Once funds enter an exchange address and mix with other funds, individual units cannot be traced one-for-one.
• XDCScan exchange labels are useful public indicators, but confirmation of the controlling entity ultimately depends on the relevant exchange.

8. Key Transaction Hashes

Prior Transaction History for Reference

The following records document on-chain history and explorer labels. They do not indicate that the named exchange was involved in the incident.

Transaction	TXID
0xaa1c... → 0xe90b..., 46,634.29999999 XDC	0x2c0e...afc6
0xe90b... → XDCScan label “Bitrue 3”, 46,634.29998231 XDC	0xd023...bf15
0xaa1c... → primary collector, 55,148.499684 XDC	0x2e56...badf6

Primary Collector to 0xff5d...

Amount	TXID
500,000 XDC	0x2f8f...3954
1,000,000 XDC	0x622c...bf85
1,000,000 XDC	0xdf9a...6793
1,000,000 XDC	0x07d4...b4d7
800,000 XDC	0xe5fd...f6e3
1,000,000 XDC	0xf4ed...79f8
1,000,000 XDC	0x2165...fbdd
1,431,410 XDC	0x987c...3da2
500,000 XDC	0x2d88...4774

Examples from 0xff5d... to Huobi 1

Amount	TXID
499,999.999524 XDC	0x3fc0...49d
999,999.999855 XDC	0x3ebb...430a
999,999.999714 XDC	0xa38a...f371
1,431,409.997424 XDC	0x6385...a72
500,000.001307 XDC	0xaf3e...b9eb

9. References

• Source of the investigated address: X post by @alwaysbplottn
• DCENT: App Wallet Incident Progress Report
• DCENT: How to Determine Whether an App Wallet Is Affected
• DCENT FAQ: App Wallet Security Issue
• DCENT: Asset Migration Guide
• Third-party technical analysis: DCENT XRP Incident
• XRPL.to: On-chain estimate of 12.4 million XRP
• XDCScan: Primary address
• XDCScan: Intermediate collector 0x1f15...65fe
• XDCScan: Parallel collector 0x1f6e...d6959a
• XDCScan: Bitrue 3
• XDCScan: Huobi 1
• Official XDC JSON-RPC Documentation

10. Final Assessment

The on-chain behavior strongly indicates a bulk collection operation performed by an actor that had obtained many private keys in advance, rather than isolated phishing or accidental transfers. The activity is highly consistent with the known DCENT App Wallet signing issue, but conclusive attribution requires off-chain records from DCENT and affected users.

The most important currently identified off-ramp is the relationship between 0xff5d...c029 and Huobi 1. HTX may be able to identify the internal account credited by these deposits. A request to freeze relevant assets and preserve KYC data, access logs, and subsequent withdrawal records should therefore be prioritized.

Approximately 3.33 million XDC remained at the primary collector at the time of this investigation. The next transfer may route funds to another exchange, bridge, DEX, or blockchain, so near-real-time monitoring is recommended.