The D'CENT app wallet drain has expanded into its seventh day, with a new victim losing more than $100,000 across two blockchain networks. The incident follows earlier reports of a large-scale attack that compromised thousands of accounts.
The latest attack targeted both the Stellar blockchain and the XRP Ledger (XRPL). On Stellar, the victim's account created a new address at 03:38 UTC on September 23 and transferred 17,244 XLM, valued at approximately $3,600, to an attacker-controlled wallet. The stolen tokens were moved to the Changelly exchange roughly four hours later.
The majority of the victim's losses came from XRP holdings. On the XRPL, attackers triggered the creation of a new address and transferred 72,521 XRP valued at over $117,000, followed by an additional 2,488 XRP worth about $4,000, leaving the victim's account empty. Approximately 75,000 XRP in total was drained, with funds subsequently moved through multiple transactions and eventually reaching Binance.
Broader Campaign Timeline
The attack campaign began on September 15, 2026, when attackers emptied 1,682 XRP Ledger wallets between 15:35 and 18:55 UTC in the first wave. The initial breach targeted 11.7 million XRP across 6,678 wallets by September 20, with attackers also deleting 5,001 accounts. Approximately 5.6 million XRP was converted to Ethereum during the campaign.
Response and Ongoing Risk
D'CENT has instructed users of its app wallets to withdraw all assets immediately. The continued activity through September 23 demonstrates that the attack campaign remains active well beyond its initial phase.
