TLDR
An ongoing security incident involving the D'CENT App Wallet has now drained about 12.4 million XRP from thousands of XRP Ledger wallets.
- A continuing drain tied to the D'CENT App Wallet has taken about 12.4 million XRP from roughly 7,400 wallets, with attacks still observed after users were warned.
- The XRP Ledger itself was not hacked; attackers are using compromised private keys, and repeated reuse of old wallet addresses is keeping some users exposed.
- D'CENT and investigators are tracing funds and issuing migration instructions, but users should expect more on-chain movement and phishing attempts as the incident unfolds.
Deep Dive
1. Scale And Mechanics Of The Drain
Recent reporting finds that a continuing drain linked to the D'CENT App Wallet has taken 12,402,589 XRP from 7,393 XRP Ledger wallets, using the same keys even after initial warnings to move funds were issued. TokenPost notes fresh activity between 21 and 25 September, including several hundred thousand XRP swept in multiple waves.
Earlier coverage explains that this builds on initial six attack waves in mid September, bringing total losses to around 12.4 million XRP across D'CENT-linked app wallets, with some addresses being emptied, refilled, and emptied again. U.Today emphasizes that this is an ongoing pattern, not a single one-off theft.
2. Why This Is A Key-Compromise, Not An XRPL Hack
Reports make clear that the XRP Ledger is functioning as designed and that transactions from affected accounts were validly signed with keys the attacker controlled. The incident is tied to D'CENT's App Wallet environment and the way recovery phrases and keys were created or stored, not a protocol-level exploit of XRPL.
D'CENT has told users to update the app only from official stores, create a new wallet with a new recovery phrase, move assets to a new address, and avoid reusing previous addresses for deposits, signing, or token approvals. Hardware wallets are only exposed if their recovery phrase was ever entered into the vulnerable app, so some users remain safe if their keys never touched that software stack.
The main risk is compromised keys and reused addresses, so the fix is key rotation and migration, not waiting for an XRPL patch that will not come.
3. What To Watch Next
D'CENT says it is working with law enforcement, exchanges, and external security specialists to trace funds and seek freezes at custodial chokepoints, even though native XRP cannot be frozen at the ledger level. TokenPost also notes millions of XRP already swapped to other chains and accounts deleted, showing active laundering attempts.
At the same time, media and data providers are warning about follow-on phishing, fake update emails, and scam software pretending to fix the issue. Users should expect further on-chain movements from attacker-controlled wallets, plus additional guidance from D'CENT and exchanges about any coordinated freezes or recovery efforts.
Conclusion
The 12.4 million XRP drain is a large but localized security failure centered on D'CENTs App Wallet and compromised keys, not a systemic flaw in XRP Ledger itself. The practical implications are key hygiene and address rotation for affected users, while the broader XRP market so far treats this as a wallet-level incident rather than a fundamental protocol risk.
CoinsKid.Com