Hackers made off with approximately 11.7 million XRP from thousands of users of the D’CENT App Wallet. Taking place between September 15 and 20, the theft amounted to nearly $20 million. On-chain forensic details were outlined by XRPL.to.
Carried out across six distinct waves, the operation targeted a total of 6,678 wallets by leveraging keys already in the perpetrator’s possession.
How the Attack Actually Unfolded
Within a single hour on September 15, an individual manually emptied eight wallets, each containing more than 99,999 XRP. Later that same day, an automated script swept an additional 1,682 wallets.
Five subsequent waves took place through September 20, with every wave relying on the exact same stolen keys, manual tool, and script.
According to XRPL.to, the attackers also purged 5,001 accounts completely in order to collect their remaining reserve balances.
Significantly, 2,470 of those accounts had never undergone a prior sweep. This indicates that the thief possessed a wider database of compromised keys than what appeared in the initial draining phase.
The pilfered assets were quickly transferred. Around 5.6 million XRP made its way onto Ethereum via THORChain, while remaining amounts passed through centralized platforms like Binance, alongside platforms such as unionchain.ai and NEAR Intents.
Because the stolen funds typically reached an off-ramp within hours, the timeframe to freeze them was severely constrained. As of September 21, roughly 1.3 million XRP remained inside the attacker’s addresses.
Why Are D’CENT Users Specifically at Risk?
On September 16, D’CENT acknowledged irregular transfers impacting its App Wallet while emphasizing that its hardware wallets remained secure. The firm subsequently advised clients to transfer their funds away right away, though it has not stated whether it will provide refunds.
Crucially, the security breach did not stem from any vulnerability within the XRP Ledger. Every single wallet sweep was executed using legitimate signatures generated by the respective private keys, implying the leak occurred during the key generation or storage phase rather than via a network-level protocol flaw.
Data from XRPL.to revealed consistent fee patterns and identical scripts across all phases of the attack, pointing to a unified, coordinated perpetrator running the entire operation. Consequently, security experts advise taking a specific precaution.
Any individual who has ever utilized the D’CENT App Wallet is strongly advised to transfer their assets to a fresh wallet immediately, as the root cause of the initial key exposure has not yet been definitively identified.
At the time of publication, XRP changed hands at approximately $1.49, representing a 6% decline over the preceding 24 hours based on BeInCrypto metrics. The asset maintained a market valuation close to $93.82 billion, holding the fifth position across the broader crypto market.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights.