[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

2 clusters · 4 sources · 7 days · First seen · Last updated

D’CENT App Wallet XRP theft

Overview

Between September 15 and September 20, 2026, attackers stole approximately 11.7 million XRP, valued at nearly $20 million, from 6,678 D’CENT App Wallets. The theft was executed in six coordinated waves using stolen keys and automated scripts. Forensic analysis revealed that perpetrators utilized AccountDelete transactions to drain funds and even deleted 5,001 accounts to claim remaining reserves.

The stolen assets were moved through various services, including THORChain for conversion to Ethereum, as well as unionchain.ai, NEAR Intents, and Binance. While the App Wallets were compromised, D’CENT confirmed that its hardware wallets were not affected.

D’CENT reported its first customer complaint regarding the incident on September 16 in South Korea. The company is currently collaborating with law enforcement and security experts. Users, particularly those using App Wallet versions prior to 8.1.0, have been advised to move their assets to a new recovery phrase to secure their funds.

Entities

Binance · THORChain · XRP · D’CENT · XRP

Timeline

  1. [TECHNOLOGY] 2 sources
    XRP theft: $20 million stolen from 6,678 wallets

    Approximately $20 million in XRP was stolen from over 6,600 wallets in a series of six waves, prompting security warnings from DCENT.

  2. [TECHNOLOGY] 2 sources
    D’CENT App Wallets compromised in $20 million XRP theft

    Attackers stole 11.7 million XRP, worth nearly $20 million, from thousands of D’CENT App Wallets in a coordinated six-wave attack between September 15 and 20.

Sources

coin-turk.com · it-boltwise.de · klamm.de · techxeber.az