A security breach in the D’CENT App Wallet resulted in the theft of approximately 12.4 million XRP between September 15 and September 25. Attackers compromised private keys in app versions older than 8.1.0, which was released on November 5, 2025. The incident affected 7,393 wallets, with 6,095 accounts being completely deleted.
The first wave of the attack occurred on September 15, when 3.6 million XRP was drained from 1,682 wallets in under three hours. Despite public warnings, theft continued, with over 640,000 XRP stolen after September 21. Hardware wallet users remained safe unless they had imported their recovery seed phrases into the compromised software.
Attackers laundered roughly 6.3 million XRP through the THORChain protocol by swapping the funds for Ethereum. From there, assets were moved to centralized exchanges such as Binance. As of September 25, about 1.4 million XRP remained in addresses controlled by the attackers, and D’CENT is currently working with law enforcement to trace and freeze the funds.
D’CENT advises users to stop using old wallet addresses and to avoid reusing recovery phrases that were previously entered into the affected app versions. The company has not yet fully disclosed the specific mechanism behind the private key compromise, noting that the issue was limited to the software-side implementation rather than their biometric hardware devices.
