D'CENT App Wallet Breach Drains 12.4M XRP From 7,393 Users
In brief
- D'CENT App Wallet breach stole 12.4M XRP from 7,393 wallets over 10 days (Sept 15–25)
- Initial attack drained 3.6M XRP from 1,682 wallets in under three hours
- 6.3M XRP already laundered via THORChain to centralized exchanges including Binance
- Vulnerability affected app versions older than 8.1.0; hardware wallet users safe unless recovery seeds imported
The Attack Unfolds
The first wave hit fast. On September 15, attackers drained around 3.6 million XRP from 1,682 wallets in under three hours. Users began flagging suspicious activity on September 16, one day after the initial assault. But the bleeding didn't stop there.
More than 640,000 XRP was stolen after September 21, suggesting some users had not seen alerts or automated scripts were still running. By the time on-chain observers tallied the damage, 6,095 accounts had been deleted entirely.
The Laundering Trail
Speed matters in theft. That's the kind of speed that suggests pre-positioned access rather than a real-time exploit, meaning the key compromise likely predated the actual theft by some margin. The attackers knew what they were doing.
Roughly 6.3 million XRP, just over half the total haul, has already been laundered. Attackers swapped the stolen XRP to Ethereum using THORChain, a decentralized cross-chain liquidity protocol that does not require user identification. From there, the funds were routed to centralized exchanges including Binance. As of September 25, approximately 1.4 million XRP remained in monitored attacker-controlled addresses, with activity still ongoing.
What Went Wrong
The vulnerability was tied to D'CENT App Wallet versions older than 8.1.0, which was released on November 5, 2025. Hardware wallet users were not affected, unless they had imported their recovery seed phrase into the compromised app.
D'CENT has not fully disclosed the exact mechanism behind the key compromise. The company says it is working with law enforcement to trace and freeze stolen funds, but the speed of the laundering operation suggests a race against time that may already be lost.
