XRP wallet drain triggers critical user warning

TLDR

A major security incident has drained millions of XRP from D'CENT App Wallets, triggering urgent warnings to XRP holders about compromised keys and unsafe legacy wallet setups.

1. Attackers have stolen roughly 12 million XRP across thousands of D'CENT App Wallets, using valid keys and repeated sweeps over several days.
2. The risk comes from exposed wallet keys and vulnerable app versions, not from an exploit of the XRP Ledger or XRP itself.
3. Users are being urged to follow D'CENT's official migration and scam?warning guidance and to monitor ongoing investigations and any further drain activity.

Deep Dive

1. Scale Of The Drain

Blockchain analysis shows that about 11.7 million XRP, close to 20 million dollars, was drained from 6,678 D'CENT App Wallets in six attack waves between 15 and 20 September, with all transactions validly signed using compromised keys, according to on chain forensics by XRPL.to and summarized by outlets like Cryptoslate.

Follow up analysis reports that the continuing drain has now reached about 12.4 million XRP taken from 7,393 XRP Ledger wallets, including fresh victims and wallets that were emptied, refilled and then emptied again, as detailed in a Tokenpost incident update.

A separate but related stress point is that Bitget, a centralized exchange, saw about 102.9 million XRP drained from its hot wallets, making XRP the largest asset in a roughly 351 to 357 million dollar breach, though user funds are expected to be covered by its protection fund.

2. Source Of The Risk

Investigators and D'CENT are clear that there is no exploit of the XRP Ledger in this incident; every malicious transaction uses a valid signature, meaning the underlying problem is key exposure rather than a protocol flaw, as emphasized in multiple forensic summaries.

Reports indicate that affected users were often on older D'CENT App Wallet builds and that attackers used scripts to sweep funds and even delete accounts to claim reserved balances, while routing more than 5.6 million XRP through services such as THORChain and centralized exchanges to off ramp quickly.

D'CENT has said that hardware wallets themselves were not directly compromised, and that the vulnerability path appears tied to how recovery phrases and signing activity interacted with the App Wallet, which is still under active investigation.

3. What Users Should Watch

D'CENT and security researchers are issuing critical warnings, urging App Wallet users to update only via official stores, follow the in app check if action is needed workflow, migrate funds to wallets created with new recovery phrases, and avoid reusing old addresses, as captured in alerts like Never send XRP to old App Wallet from U.Today.

They also highlight a growing wave of phishing around the incident, including fake emails claiming missed update windows and directing users to download malicious software, and D'CENT has stressed that it will never ask for recovery phrases or keys via direct messages.

Ongoing risks include continued use of compromised keys, movement of stolen XRP through bridges and smaller services that are harder to police, and potential copycat attacks that target other wallet apps or inattentive users who have not yet followed official guidance.

Conclusion

The XRP wallet drain is a large, coordinated compromise of wallet keys tied to the D'CENT App Wallet, not a failure of the XRP Ledger itself, but it has still removed tens of millions of dollars of user funds.

For crypto users, the key lesson is that wallet security and recovery phrase hygiene are as critical as protocol design, and that following verified provider guidance and staying alert to phishing is essential whenever a wallet level incident like this unfolds.