Attackers steal nearly $20 million in XRP from thousands of D'CENT wallets

Attackers drained roughly 11.7 million XRP worth close to $20 million from D'CENT App Wallet users. The theft affected 6,678 wallets whose keys attackers already controlled. The operation unfolded across six waves between September 15 and September 20. Attackers manually drained eight wallets holding more than 99,999 XRP each within an hour on September 15. An automated script then swept 1,682 wallets that day. Attackers used the same script, manual tool, and stolen keys in the five later waves. Attackers deleted 5,001 accounts to claim their remaining reserve balances. A total of 2,470 deleted wallets had never been swept. That detail suggests the attackers had a broader list of compromised keys than the initial drain revealed. XRPL.to published the on-chain forensic timeline. Roughly 5.6 million XRP moved into Ethereum through THORChain. Other funds moved through exchanges including Binance and services including unionchain.ai and NEAR Intents. Each sweep often reached an off-ramp within hours. About 1.3 million XRP remained in the attackers' wallets as of September 21. D'CENT confirmed abnormal transfers affecting its App Wallet on September 16. D'CENT said its hardware wallets were unaffected. D'CENT urged users to move their funds immediately. D'CENT has not confirmed whether it will provide reimbursement. The incident did not result from an XRP Ledger exploit. Every sweep used valid signatures from the wallets' own private keys. XRPL.to found identical scripts and fee patterns across multiple waves. That pattern strongly suggests one coordinated actor carried out every stage. The method used to compromise the original keys remains unconfirmed. XRP traded near $1.49 at the time of writing. The token had fallen 6% over the previous 24 hours. Its market capitalization stood near $93.82 billion and ranked fifth among cryptocurrencies.