Breaches and incidentsBriefConfirmed by two or more outlets
D’CENT App Wallet: about 11.75M XRP drained from 6,678 wallets
15 Sep 15:35 UTC to 20 Sep 20:56 UTC: XRPL.to counted 11.75M XRP (about USD 18.7M) taken from 6,678 wallets in six waves.
- Disclosed
What happened
- 15 Sep 15:35 UTC to 20 Sep 20:56 UTC: XRPL.to counted 11.75M XRP (about USD 18.7M) taken from 6,678 wallets in six waves. Other counts run to about 12.4M XRP and 7,393 wallets.
- Root cause: not disclosed. D’CENT’s impact criteria cover recovery phrases used in its mobile App Wallet that signed with an app version earlier than 8.1.0 (released 5 Nov 2025). Hardware users are affected only if they entered their phrase into the app.
- Attribution: none.
- Response: D’CENT is working with Korean law enforcement and requesting freezes. No freeze or recovery announced. Users told to update and move funds to a new recovery phrase.
Sources
- https://cryptoslate.com/nearly-20-million-in-xrp-drained-from-6678-wallets-across-six-attack-waves/
- https://blockhead.co/2026/09/23/dcent-app-wallet-flaw-linked-to-theft-of-millions-of-xrp
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.