US$20 Million XRP Vanishes from 6,678 Accounts, D'CENT App Wallet Attacked

For six consecutive days, September 15 to 20, 2026, an automated script worked nonstop to empty user wallets one by one. The total XRP stolen from this incident reached 11.7 million tokens, equivalent to almost US$20 million, from 6,678 D'CENT Wallet accounts. 

What makes this case worth noting is actually the target: the XRP Ledger network itself was not breached, but the access keys of thousands of App Wallet users had somehow already leaked into the attacker's hands. 

The question now widely asked by the crypto community: is the D'CENT hardware wallet also affected, and how safe is storing assets on this platform after the incident?

Key Takeaways

• 11.7 million XRP (~US$20 million) stolen from 6,678 D'CENT App Wallet accounts through six waves of attacks on September 15–20, 2026.
• This was not an XRP Ledger network exploit — the attacker used stolen private keys that produced valid transaction signatures.
• D'CENT physical hardware wallets are confirmed safe; only App Wallet users (software/mobile version) were affected.

How Could 11.7 Million XRP Be Stolen from D'CENT Wallet?

According to on-chain forensic tracing by analytics firm XRPL.to as reported by BeInCrypto and CryptoSlate, the first attack occurred on September 15 at 15:35 UTC. 

Eight large wallets, each holding more than 99,999 XRP, were drained manually in less than an hour. An automated script then followed the same day, sweeping a total of 1,682 wallets at once.

Five subsequent waves continued until September 20 at 20:56 UTC, all using the same scripts, manual tools, and stolen keys. The identical fee patterns and execution methods in each wave led XRPL.to to conclude that the entire operation was carried out by a single actor.

Read Also: BIS Reveals New Potential for XRP Ledger for the Digital Financial System

The attacker did not stop at ordinary transfers either. As many as 2,470 of the 6,678 victim wallets were emptied through AccountDelete transactions, which fully close the account to redeem the remaining reserve that is usually untouched by normal transfers. 

There were a total of 5,001 AccountDelete transactions from 4,950 wallets, including one account deletion that alone drained 107,507 XRP, or about US$171 thousand.

Want to start monitoring crypto asset movements in real time on a more transparent platform? You can register an account on Bittime, which is officially licensed by OJK.

Where Did the Stolen Funds Flow?

Most of the stolen XRP had already moved cross-chain before the investigation was completed. XRPL.to recorded 5.67 million XRP routed through THORChain to Ethereum, making it the largest route. 

Other routes were also used: 3.24 million XRP flowed to unionchain.ai, 546,080 XRP to NEAR Intents, and 535,666 XRP went to a Binance deposit tag. The remainder, about 1.31 million XRP, was still sitting in the attacker's wallet as of the last snapshot.

Read Also: Popular Tokenized Stocks 2026: Technology Stocks Become Investor Favorites

The combination of cross-chain bridges such as THORChain and NEAR Intents is what makes tracking increasingly complicated, because the fund trail breaks once assets move across networks. 

Addresses connected to exchanges like Binance could actually be an intervention point, but the status of the funds there (already sold or still sitting) cannot be determined from on-chain data alone.

Is D'CENT Hardware Wallet Safe? These Are the Risk Criteria for Users

D'CENT, a South Korean wallet made by security company IoTrust, first confirmed suspicious transfers on September 16. The company emphasized that its physical hardware wallets were not affected; the target was the App Wallet, the software version that runs on mobile phones.

The risk criteria for users are quite specific: anyone who has ever entered or restored a recovery phrase into the App Wallet, or signed transactions with an app version below 8.1.0 (released November 5, 2025). 

This also applies to owners of genuine hardware wallets, because moving the same recovery phrase to a new device does not generate a new private key — the previous exposure is still carried over.

Read Also: 10+ Best AI Coins 2026: Here's the List of Artificial Intelligence Crypto! 

D'CENT urged all affected users to immediately move assets to a new wallet with a completely new recovery phrase, while updating the app through the official app store. 

The company also warned of follow-up scam waves: some parties claim to be from D'CENT and ask for recovery phrases or wallet addresses for "fund recovery" — D'CENT emphasized that it never makes such requests. 

The investigation is still ongoing with South Korean law enforcement and exchanges, but so far there has been no officially confirmed freezing of funds or asset recovery.

Read Also: 10 Largest RWA Crypto Asset Tokenizations in the World

Conclusion

The D'CENT App Wallet case shows that the biggest risk in crypto storage is often not in the blockchain network itself, but in the access points that connect it to the user's device. 

Of the 11.7 million XRP that vanished, most had already moved cross-chain through cross-network bridges, making full recovery unlikely, while D'CENT is still limiting the impact by ensuring physical hardware wallets remain safe.

For anyone who has ever touched this App Wallet, migrating to a new recovery phrase is no longer an option, but a necessity to prevent further losses.

Check the price of Bitcoin (BTC), Ethereum (ETH), XRP, Solana (SOL), GRAM, and BNB as well as leading memecoin DOGE. You can trade directly on Bittime!

Bittime is a Digital Financial Asset Trader (PAKD) platform licensed and supervised by the Financial Services Authority — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from Rp10,000. Registration is fast, secure, and can be started today.

Monitor the conversion of USDT to IDR and the price movements of your favorite crypto assets in real time. All available in one crypto investment app that can be downloaded for free on the Play Store.

Ready to start? Register now on Bittime and execute your investment strategy with a platform trusted by millions of users in Indonesia.

FAQ

Is D'CENT Wallet safe to use now? 

D'CENT physical hardware wallets are reported to remain safe, but the App Wallet (software version) targeted in this attack has not been fully restored. App Wallet users are advised to immediately migrate to a new recovery phrase before continuing to use it.

Was the D'CENT hardware wallet also affected by this hack? 

No, D'CENT confirmed that physical hardware wallet devices were not affected by this incident. The risk only applies to users who have ever entered their recovery phrase into the App Wallet.

Why was XRP stolen from D'CENT Wallet if it was not an XRP Ledger network bug? 

All theft transactions used valid signatures from the victims' own private keys, meaning the XRP Ledger network was functioning normally. The source of the private key leak itself has not yet been disclosed by D'CENT.

What should D'CENT App Wallet users do now? 

Immediately move assets to a new wallet with a completely new recovery phrase, and update the app through the official app store. Never share your recovery phrase or send funds to anyone claiming they can recover assets via DM or unofficial channels.