D'CENT hack, year's second-largest XRP theft, spreads to Bitcoin and Ethereum

Hackers drained more than 12.4 million XRP from more than 7,000 D'CENT wallets. The theft was the year's second-largest XRP drain, behind the Bitget crypto exchange hack, which lost 102.9 million XRP. The hack involved an $18 million loss for XRP holders. D'CENT users also lost assets on blockchains beyond XRP. D'CENT's disclosure named Bitcoin, Tron and Ethereum. A Stellar user lost XLM in the incident. Hackers could sweep funds across blockchains using one compromised recovery phrase for the multi-blockchain wallet. IoTrust confirmed at least 110 reports of abnormal transfers, including reports involving non-XRP assets, according to ZDNet Korea. At least six waves of theft occurred between September 15 and 20. The waves emptied 6,678 wallets of 11.7 million XRP. The thief first manually targeted large wallets. The thief soon wrote scripts to take funds from progressively smaller wallets. Warnings from D'CENT and other members of the XRP community did not stop the theft. Thieves took an additional 640,370 XRP after September 21. The total then exceeded 12.4 million XRP. By Friday, 6.3 million of the stolen XRP had crossed to Ethereum's blockchain through the swap service THORChain. Researchers said most of the stolen assets were no longer XRP. In August, D'CENT promoted its hardware wallets' secure element as impervious to vulnerabilities linked to the Coldcard hack. D'CENT now warns users that wallets created using its app are vulnerable. D'CENT urges users to create a fresh recovery phrase and immediately migrate everything, including tokens, NFTs and staked assets.