D'CENT app wallet attack drains 12.4 million XRP from thousands of users

A security breach targeting older versions of the D'CENT App Wallet has resulted in the theft of approximately 12.4 million XRP from 7,393 wallets between September 15 and September 25, 2026. Attackers exploited compromised private keys in app versions older than 8.1.0, deleting 6,095 accounts and laundering over half of the stolen funds (6.3 million XRP) via THORChain and Binance. D'CENT has urged users to update their apps, migrate funds to new secure wallets, and beware of ongoing phishing scams.

Overall impact of the breach

• ▪A security breach targeting the D'CENT App Wallet resulted in the theft of approximately 12.4 million XRP from 7,393 wallets
• ▪The security breach targeting the D'CENT App Wallet between September 15 and September 25, 2026, resulted in the complete deletion of 6,095 affected accounts

Timeline of the wallet drains

• ▪On September 15, 2026, attackers drained around 3.6 million XRP from 1,682 D'CENT App Wallets in under three hours using manual and automated methods
• ▪Between September 21 and September 25, 2026, attackers behind the D'CENT App Wallet breach stole an additional 640,370 XRP from D'CENT App Wallets
• ▪During the security breach of D'CENT App Wallets, 76 wallets were emptied, refilled, and emptied again by the attackers
• ▪The theft of approximately 12.4 million XRP from D'CENT App Wallets occurred over a 10-day window stretching from September 15 to September 25, 2026

Movement of the stolen funds

• ▪Attackers laundered approximately 6.3 million XRP stolen from D'CENT App Wallets by swapping them to Ethereum using THORChain, then routed the funds to centralized exchanges, including Binance
• ▪As of September 25, 2026, approximately 1.4 million XRP stolen from D'CENT App Wallets between September 15 and September 25, 2026, remained in monitored attacker-controlled addresses

D'CENT recommendations for users

• ▪D'CENT warned users never to send XRP to old App Wallet addresses and to avoid reusing recovery phrases that were ever entered into compromised app versions
• ▪D'CENT advised users affected by the D'CENT App Wallet security breach to update the D'CENT app to the latest version and move their assets to a newly created secure wallet generated with a new recovery phrase

Debatable claims

• ▪D'CENT should fully disclose the technical mechanism of the wallet exploit
• ▪D'CENT is responsible for reimbursing users hit by the app wallet exploit
• ▪Cooperating with law enforcement to freeze stolen assets compromises cryptocurrency's core principles