XRP: $18.7 million siphoned from 6,678 D’CENT wallets

Six waves, 6,678 victims. Between September 15 and 20, 11.75 million XRP were siphoned from thousands of wallets linked to the mobile app of D’CENT, a South Korean manufacturer of hardware wallets. At the current price of around $1.59, the total theft amounts to $18.68 million.

Despite being alerted, the D’CENT team was unable to intervene in time to prevent the drain.

Key Takeaways

• Attackers stole 11.75 million XRP ($18.68 million) from 6,678 accounts over six days.
• The attackers utilized the XRP Ledger's AccountDelete instruction to drain even the minimum account reserves.
• 5.67 million tokens were bridged via THORChain to Ethereum, while others ended up on Binance, NEAR Intents, and unionchain.ai.
• D’CENT is requiring a migration to a new seed phrase, including for owners of exposed hardware wallets.

XRP: AccountDelete function exploited to scrape funds

D’CENT states it received its first customer report in South Korea on September 16, the day after the initial withdrawals, and immediately alerted its users via the app and official channels. However, these alerts were not enough to stop the bleeding.

XRPL.to has since reconstructed the timeline of the theft, transaction by transaction. The first identified withdrawal occurred on September 15 at 3:35 PM UTC. A new wave of draining began two days later, on September 17 at 7:05 AM UTC. The last recorded withdrawal took place on September 20 at 8:56 PM UTC. During this period, the attackers drained 6,678 wallets, either fully or partially. To achieve this, they used standard payment transactions on 4,208 accounts and account closures on the remaining 2,470.

Everything hinged on the AccountDelete instruction. XRPL.to identified 5,001 such transactions, executed from 4,950 wallets, including accounts that had already been partially drained.

Every XRP Ledger account must hold a minimum reserve to remain open, currently set at a few XRP. This amount remains inaccessible via standard payments. AccountDelete, however, closes the eligible account and sends the remaining balance to a destination address, minus the deletion fee. The attackers essentially scraped the bottom of the barrel. One such deletion moved 107,507 XRP in a single go—roughly $171,000.

Crucially, all these transactions were validly signed with the keys of the affected accounts. The XRP Ledger functioned exactly as intended and experienced no failures. The compromise occurred upstream, at the private key level, and the blockchain provides no evidence of how those keys were leaked.

As of now, D’CENT has yet to disclose the technical cause of the leak.

Crypto: 5.6 million XRP moved through THORChain

Unsurprisingly, by the time investigators began tracing the flows, the bulk of the loot had already left the XRP Ledger. By September 21, XRPL.to had identified 5.67 million XRP that had already moved through THORChain, including approximately 5.59 million from two waves of draining, with transaction memos pointing to Ethereum destination addresses.

The rest was scattered. XRPL.to tracks 3.24 million XRP sent to unionchain.ai and 546,080 XRP arriving on NEAR Intents. Additionally, 535,666 XRP were funneled into Binance deposit addresses. About 1.31 million XRP remained in wallets linked to the operation at the time of the analysis.

These fund manipulations were not improvised. THORChain and NEAR Intents allow funds to be bridged from one blockchain to another without intermediaries. Consequently, no one has the power to freeze these assets, forcing investigators to restart their tracking on every new network.

The 535,666 XRP sent to Binance offer a glimmer of hope for the victims. Centralized exchanges can block deposits upon notification, provided they are alerted before the funds are converted. To secure such freezes, D’CENT says it is working with South Korean authorities and external security experts. The company is also reaching out to blockchain projects and exchanges. At this stage, no freezes or recoveries have been announced.

D’CENT urges users to abandon their seed phrase

In light of the ongoing withdrawals, D’CENT took a stricter stance on September 20. They also requested the crypto community to help spread the alert to users who might have missed the news.

"The most important step to avoid further damage is to move assets out of the D’CENT App Wallet."

D’CENT, hardware wallet manufacturer, on X

The required action consists of two steps: update the app from an official store, then transfer all assets to a wallet generated from an entirely new seed phrase. This instruction applies well beyond just mobile app users.

Anyone who has ever entered or restored their hardware wallet recovery phrase into the App Wallet must also migrate. The reason is a principle rarely emphasized to beginners: reusing the same seed phrase on a new device does not generate new private keys. The keys are mathematically derived from the phrase. If the phrase has been leaked once, it remains compromised regardless of the hardware hosting it.

D’CENT considers an account exposed if three conditions are met: the seed phrase was entered into the App Wallet, the account has signed a transaction, and that signature was made with an application version prior to 8.1.0, released on November 5, 2025.

Conversely, a hardware wallet whose phrase has never been entered into the application, and which has never signed via the software wallet, is not considered affected under the company's current criteria.

For the 6,678 accounts already emptied, D’CENT indicates it is still developing a procedure to measure the extent of the losses and determine the status of the assets. As of today, the South Korean manufacturer has promised no compensation and has set no timeline.

The news that matters, summarized in 2 minutes. Monday to Friday, delivered to your inbox.