Sep 15, 2026
2 new drains.
New
-
Critical✕Still active
D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron
From 15 to 20 September 2026 thieves emptied at least 6,678 wallets created in the D'CENT mobile app in six waves, taking about 11.7M XRP, and kept draining after 21 September for a total above 12.4M XRP (over $18M per Protos). D'CENT's own disclosure also named Bitcoin, Tron and Ethereum, and the stolen XRP was moved to Ethereum through THORChain. The cause is compromised recovery phrases for wallets made in the app; how they leaked has not been explained. D'CENT says app-created wallets are vulnerable and tells users to make a new recovery phrase and move everything.
D'CENT mobile App Wallet users (wallets created in the app)·Ethereum, Tron, Bitcoin·$18M stolen·Since Sep 15, 2026·
-
Critical◐Partly contained
Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief
On 15 September 2026 an attacker abused a custom Uniswap v4 liquidity module and a Multicall helper that an Ethereum Safe multisig owner had approved, pointing the wallet's position at a malicious pool and unwrapping about 2,882 rsETH (around $7.8M). Blockaid described it as abuse of module permissions on that one Safe, not a bug in Safe itself or a stolen owner key. MEV bot Yoink front-ran the attacker and took the funds, Kelp DAO froze that address within about two hours, and whether the funds come back is unresolved. Safe owners should audit every enabled module.
A user's Safe multisig with a custom Uniswap v4 liquidity module·Ethereum·$7.8M stolen·Since Sep 15, 2026·