Approximately $18.68 million worth of XRP was stolen from 6,678 distinct wallets in six coordinated waves between September 15 and September 20, according to blockchain analysis firm XRPL.to. The attack targeted users of D'CENT's mobile App Wallet, prompting the company to issue escalating warnings and recommend immediate asset migration.
Attack Timeline and Scale
XRPL.to identified the first sweep at 15:35 UTC on September 15, with subsequent waves continuing through September 20. The investigation documented 4,208 wallets emptied through standard payment transactions and 2,470 wallets cleared through account deletion transactions. An additional 5,001 AccountDelete transactions originated from 4,950 wallets, some of which had already been partially drained.
D'CENT received its first customer report of unauthorized transfers on September 16 from a user in Korea and began notifying affected users that same day through its app and official channels.
Technical Details of the Theft
The transactions were validly signed with the affected accounts' private keys, according to XRPL.to's analysis. Account deletion transactions proved particularly effective, as they allowed attackers to extract XRP that standard payment sweeps could not access. One such deletion transaction moved 107,507 XRP, worth approximately $171,000 at current prices.
XRPL.to confirmed that the blockchain trail does not reveal how the private keys were compromised, and D'CENT has not yet disclosed the technical cause of the incident.
Fund Movement and Recovery Challenges
Much of the stolen XRP has already left the XRP Ledger. XRPL.to traced 5.67 million XRP through THORChain as of September 21, with approximately 5.59 million sent from collection waves through transactions specifying Ethereum destination addresses. An additional 3.24 million XRP moved to unionchain.ai, described as an exchange, while 546,080 XRP reached NEAR Intents and 535,666 XRP moved into Binance deposit addresses.
Around 1.31 million XRP remained in wallets linked to the operation at the investigator's snapshot. The routing through cross-chain bridges and exchanges complicates recovery efforts, as funds may be exchanged for assets on other blockchains or held in deposit addresses.
D'CENT stated it has been working with Korean law enforcement, security specialists, blockchain projects, and exchanges to trace the funds and request asset freezes where possible. The company has not announced a completed freeze or recovery, noting that such actions depend on law enforcement and third parties controlling the services involved.
Recommended Actions for Users
D'CENT advised affected users to take several steps to prevent further losses. Users should update the app from an official app store, then move their holdings to a wallet created with an entirely new recovery phrase. This requirement extends to hardware wallet users who previously entered or restored their recovery phrase within D'CENT's App Wallet, as moving the same phrase to a new device does not generate new private keys.
D'CENT identified additional risk factors for hardware wallet users: those whose recovery phrase was used in the App Wallet and who signed transactions with app versions earlier than 8.1.0 released November 5, 2025. Users who later upgraded the software should consider which version was active when they previously signed transactions.
Hardware wallet users who never entered their recovery phrase into the App Wallet and never used the software to sign transactions do not require migration under current criteria.
The company warned users against impersonators exploiting the incident. D'CENT will never request a recovery phrase, private key, PIN, or provide a wallet address for asset recovery or compensation.
As of September 20, D'CENT indicated it was still developing a process to determine the full scope of the attack and track the status of affected assets.
