$20 Million in XRP Stolen From Thousands of D’CENT App Wallet Users

Between September 15 and September 20, attackers siphoned approximately 11.7 million XRP—valued at close to $20 million—from thousands of D’CENT App Wallet users. The theft affected a total of 6,678 wallets whose private keys had already been compromised.

How the Attack Unfolded

The operation began on September 15 with a manual drain of eight wallets, each holding more than 99,999 XRP, within an hour. An automated script then swept an additional 1,682 wallets the same day. Five further waves followed through September 20, each reusing the same script, manual tool, and compromised keys.

Account Deletions

Beyond simple transfers, the attackers deleted 5,001 accounts to claim their remaining reserve balances. Of those, 2,470 wallets had never been swept, indicating the thief possessed a broader list of compromised keys than initially observed.

Fund Movement

Approximately 5.6 million XRP was transferred to Ethereum via THORChain. Other portions were routed through exchanges such as Binance and services like unionchain.ai and NEAR Intents. Each sweep typically reached an off‑ramp within hours, limiting the window for potential fund freezing. As of September 21, about 1.3 million XRP remained in the attacker’s wallets.

Impact on D’CENT Users

D’CENT confirmed abnormal transfers on September 16 and urged users to move funds immediately. The company stated that hardware wallets were not affected and has not confirmed any reimbursement plans. No vulnerability in the XRP Ledger was involved; all transactions were signed with valid private‑key signatures, indicating the compromise stemmed from key exposure rather than a network flaw.

Market Reaction

At the time of writing, XRP traded near $1.49, down about 6 % over the previous 24 hours, with a market cap around $93.8 billion, ranking fifth among cryptocurrencies.

Recommendations

Security researchers advise anyone who has used D’CENT’s App Wallet to migrate funds to a new wallet immediately. The exact method of the original key compromise remains under investigation.