Over $20 Million in XRP Stolen from D'CENT App Wallets in Six Attack Waves

In a major security breach, approximately $20 million worth of XRP was drained from 6,678 wallets associated with the D'CENT App Wallet between September 15 and September 20. The blockchain analysis firm XRPL.to reported that nearly 11.75 million XRP was siphoned off in six distinct waves of attacks.

The first wave of the attack was identified on September 15, when eight wallets, each holding over 99,999 XRP, were manually drained within an hour. Following this, an automated script was used to sweep a total of 1,682 wallets on the same day. The subsequent waves continued until September 20, with attackers employing the same scripts and stolen keys throughout the operation.

Notably, the attackers not only transferred funds but also deleted 5,001 accounts to claim remaining reserve balances, indicating they had access to a broader set of compromised keys than initially suspected. The stolen XRP was rapidly moved to various platforms, including THORChain, where approximately 5.6 million XRP was transferred to Ethereum, and other exchanges like Binance and unionchain.ai.

DCENT confirmed the abnormal transfers affecting its App Wallet on September 16 and has since urged users to migrate their funds to new wallets. The company has been collaborating with law enforcement and security experts to trace the stolen assets and request freezes where possible. However, no confirmation of asset recovery has been made as of yet.

Importantly, the incident did not stem from an exploit in the XRP Ledger itself; all transactions were signed with valid keys from the affected wallets, suggesting the compromise originated from how those keys were exposed.