D'CENT wallet attack spreads to Bitcoin and Ethereum after XRP losses

The D'CENT wallet hack, which comes after the Bitget exchange breach as the second-largest XRP drain this year, has now extended to other blockchains. Bitcoin, Ethereum and Stellar are among the networks affected.

Thieves have taken more than 12.4 million XRP from over 7,000 D'CENT wallets, still a fraction of the 102.9 million XRP lost by Bitget.

The wallet was popular with XRP users, but D'CENT customers holding assets on other blockchains have also seen their funds stolen.

D'CENT's own incident report listed Bitcoin, Tron and Ethereum, for instance. Even a Stellar user has lost XLM, the report said.

Using a single compromised recovery phrase for the multi-chain wallet, the attackers can move funds across different blockchains.

Per ZDNet Korea, IoTrust — the maker of D'CENT — has confirmed at least 110 reports of abnormal transfers, some involving non-XRP assets.

Status report on unauthorized asset transfers in the DCENT App Wallet

We recognize the serious concern this issue has caused. This report is based on the facts confirmed as of September 17, 2026.

The latest DCENT app includes a check to help determine whether action may be… pic.twitter.com/k1DUKKDMYX

— DCENT Wallet (@DCENTWALLETS) September 17, 2026

D'CENT hack costs XRP holders $18 million

The XRP losses are the best documented, as D'CENT is especially popular among XRP holders.

Between September 15 and 20, at least six waves of theft took place, draining 6,678 wallets of 11.7 million XRP.

The attacker initially targeted large wallets manually, then created scripts to steal from increasingly smaller wallets.

Despite warnings from D'CENT and the XRP community, the theft continued. After September 21, an additional 640,370 XRP was stolen, pushing the total past 12.4 million.

As of Friday, 6.3 million of the stolen XRP had moved to the Ethereum blockchain via the THORChain swap service.

As the attack spread to other chains, researchers acknowledged the full extent of the damage, stating, “Most of it is no longer XRP.”

Coreum bridge loses 99.7% of XRP reserve in $200K exploit

In August, D'CENT was promoting its hardware wallets' secure element, claiming it was immune to the type of flaw found in the Coldcard hack.

D'CENT is now cautioning that wallets created through its app are at risk, advising users to generate a new recovery phrase and move all assets — tokens, NFTs and staked positions — right away.