$20 Million in XRP Stolen From Thousands of Hardware Wallets

Attackers drained roughly 11.7 million XRP from thousands of D’CENT App Wallet users. The theft, worth close to $20 million, unfolded between September 15 and 20. XRPL.to published the on-chain forensic timeline.

The operation unfolded across six separate waves. It hit a combined 6,678 wallets using keys the thief already controlled.

How the Attack Actually Unfolded

Someone manually drained eight wallets, each holding over 99,999 XRP, within an hour on September 15. An automated script then swept a total of 1,682 wallets that same day.

Five more waves followed through September 20. Each wave reused the same script, manual tool, and stolen keys.

Attackers went beyond simple transfers, too. They deleted 5,001 accounts entirely to claim their remaining reserve balances, XRPL.to reported.

Notably, 2,470 of those wallets had never been swept. That detail suggests the thief held a broader list of compromised keys than the initial drain revealed.

Follow us on X to get the latest news as it happens.

The stolen funds moved fast. Roughly 5.6 million XRP crossed into Ethereum through THORChain. Other funds are routed through exchanges, including Binance, as well as services like unionchain.ai and NEAR Intents.

Each sweep often reached an off-ramp within hours, limiting the window available for freezing stolen funds. About 1.3 million XRP still sat in the attacker’s own wallets as of September 21.

Why Are D’CENT Users Specifically at Risk?

D’CENT confirmed abnormal transfers affecting its App Wallet on September 16. The company clarified that hardware wallets remained unaffected. It later urged users to move funds immediately, though it has not confirmed whether reimbursement will follow.

Notably, no XRP Ledger exploit caused this incident. Every sweep used valid signatures from the wallets’ own private keys. That detail means the compromise originated from how those keys were exposed, not from any flaw in the network itself.

XRPL.to’s analysis found the operation reused identical scripts and fee patterns across multiple waves. That pattern strongly suggests a single coordinated actor carried out every stage. Security researchers now recommend one specific step.

Anyone who used D’CENT’s App Wallet at any point should migrate funds to a new wallet immediately. The exact method behind the original key compromise still remains unconfirmed.

XRP trades near $1.49 at the time of writing. That figure marked a 6% drop over the past 24 hours, according to BeInCrypto data. The token’s market cap stood near $93.82 billion, ranking fifth among all cryptocurrencies.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights.