D’CENT hardware wallet users lose 11.75 million XRP across coordinated attacks
Blockchain analysts have traced nearly $20 million in XRP stolen from hardware wallets made by D’CENT across six coordinated sweeps in less than a week. The blockchain trail does not reveal how the attackers obtained the affected accounts’ keys, and D’CENT has yet to disclose the technical cause of the incident.
- Attackers moved 11.75 million XRP out of 6,678 distinct wallets between Sept. 15 and Sept. 20, worth roughly $18.68 million at $1.59 per token.
- Investigators counted 5,001 AccountDelete transactions from 4,950 wallets, a technique that lets thieves extract reserve balances ordinary payment sweeps leave behind.
- As of 11:26 UTC on Sept. 21, 5.67 million XRP had already moved through THORChain, scattering the funds across multiple blockchains before any freeze could be requested.
- $18.68M value of the 11.75 million XRP stolen at current prices
- 6,678 distinct wallets swept across the six attack waves
- 5,001 AccountDelete transactions used to strip reserve balances
Blockchain analysis firm XRPL.to identified the 11.75 million XRP moving out of 6,678 wallets between Sept. 15 and Sept. 20, according to a CryptoSlate report. The transfers followed warnings from hardware wallet maker D’CENT that its mobile App Wallet had exposed users to unauthorized transfers. At XRP’s current price of about $1.59, the tokens are worth roughly $18.68 million.
XRPL.to Maps Six Sweeps That Emptied 6,678 D’CENT Wallets
XRPL.to traced the first identified sweep to 15:35 UTC on Sept. 15, over a week before this Wednesday, September 23, 2025, report. D’CENT said it received its first customer report from Korea on Sept. 16 and began notifying users through its app that same day.
The draining did not stop there. A second collection wave began at 07:05 UTC on Sept. 17, and the final sweep in XRPL.to’s dataset landed at 20:56 UTC on Sept. 20.
Of the affected accounts, 4,208 wallets were emptied through standard payment transactions while another 2,470 were closed entirely through account deletion, a split that shows attackers using two distinct extraction methods over the same five-day span.
AccountDelete Transactions Strip Reserves Payments Leave Behind
XRP Ledger accounts must hold a reserve balance to stay open, but an AccountDelete transaction can close an eligible account and forward its remaining XRP, minus a deletion fee, to another address. Attackers filed 5,001 such transactions from 4,950 wallets, a rate that suggests some accounts were both drained by payment and later closed to capture the reserve.
One deletion alone moved 107,507 XRP, worth about $171,000 at current prices.
XRPL.to confirmed the payment and deletion transactions were validly signed with the affected accounts’ own keys. D’CENT has not disclosed how those keys were obtained, and the technical cause of the incident remains undisclosed.
5.67 Million XRP Crosses Into THORChain, Binance and NEAR Intents
Much of the stolen XRP had already left the ledger by the time investigators mapped the flows. XRPL.to traced 5.67 million XRP through THORChain as of 11:26 UTC on Sept. 21, including about 5.59 million XRP sent from two collection waves carrying transaction memos specifying Ethereum destination addresses.
Another 3.24 million XRP reached unionchain.ai, roughly 546,080 XRP moved into NEAR Intents, and 535,666 XRP landed in Binance deposit tags, leaving about 1.31 million XRP still sitting in wallets linked to the operation at the time of the snapshot.
Cross-chain transfers through THORChain and NEAR Intents complicate any recovery effort, since funds exchanged for assets on another network create additional trails investigators must follow.
D’CENT said it is working with Korean law enforcement, outside security specialists and exchanges to trace the funds and request freezes where possible. The company has not announced a completed freeze or recovery.
The CCS read. This is a custody problem, not an XRP problem, and it will land on institutional desks evaluating retail wallet vendors before it affects token price. Expect prime brokers and ETF custodians to add software-wallet exposure checks to vendor due diligence, and expect D’CENT’s remediation timeline, not the theft itself, to shape how quickly affected liquidity returns to circulation.
D’CENT said on Sept. 20 it was still developing a process to determine the scope of impact and the status of affected assets, with no completed recovery announced. Whether Korean law enforcement can secure freezes on the Binance-tagged deposits before funds move again remains the open question investigators are racing to resolve.
