Nearly $20M in XRP Drained From Thousands of Digital Wallets

About 11.7 million XRP was taken from a large number of D'CENT App Wallet holders. The heist, valued at approximately $20 million, took place between September 15 and 20. The on-chain forensic details were published by XRPL.to.

The operation proceeded in six separate waves. A total of 6,678 wallets were affected, with the thief already in possession of the private keys.

How the Attack Actually Unfolded

On September 15, someone manually emptied eight wallets that each contained more than 99,999 XRP, all within an hour. Later that same day, an automated program cleared out a total of 1,682 wallets.

Through September 20, five additional waves occurred. Each wave used the same script, the same manual tool and the same stolen keys.

The attackers did more than just move funds. As XRPL.to reported, they entirely removed 5,001 accounts to collect the leftover reserve balances.

A noteworthy detail: 2,470 of those wallets had never been touched by the earlier sweeps. That suggests the thief possessed a longer list of compromised keys than the initial drain revealed.

The stolen funds were moved quickly. Around 5.6 million XRP was transferred to the Ethereum network through THORChain. Additional funds were sent via exchanges including Binance and through services such as unionchain.ai and NEAR Intents.

Each sweep often reached a cash-out point within hours, leaving little time to freeze the stolen assets. As of September 21, about 1.3 million XRP was still sitting in the attacker's own wallets.

Why Are D'CENT Users Specifically at Risk?

On September 16, D'CENT confirmed that unusual transfers were affecting its App Wallet. The company stated that hardware wallets were not impacted. It later advised users to move funds right away, though it has not said whether reimbursement will be provided.

Notably, no exploit of the XRP Ledger caused the incident. Every transfer was made with valid signatures from the wallets' own private keys. That means the compromise came from how those keys were exposed, not from a network vulnerability.

XRPL.to's analysis showed the operation used the same scripts and fee patterns across multiple waves. That pattern points strongly to a single coordinated perpetrator carrying out every stage. Security researchers now recommend one specific action.

Anyone who ever used D'CENT's App Wallet should move funds to a new wallet immediately. The exact method of the original key compromise remains unconfirmed.

XRP was trading around $1.49 at the time of writing. That price represented a 6% decline over the preceding 24 hours, according to BeInCrypto data. The token's market capitalization was roughly $93.82 billion, putting it in fifth place among all cryptocurrencies.