Massive Security Breach Drains $20 Million from D’CENT XRP Wallets
A significant security incident has shaken the XRP Ledger community as nearly $20 million in XRP was systematically drained from thousands of hardware and mobile wallets. The breach, which occurred in several waves between September 15 and September 20, impacted over 6,600 distinct accounts linked to the D’CENT wallet ecosystem. Blockchain investigators are currently tracing the movement of these funds across various decentralized protocols and exchanges, while the wallet provider urges immediate action from its user base.
The Mechanics of the Sweep
According to data from blockchain analysis firm XRPL.to, the attackers utilized six distinct collection waves to extract approximately 11.75 million XRP. The exploit was particularly thorough, employing "AccountDelete" transactions to bypass standard reserve requirements and extract the full balance of the targeted wallets. While the transactions were validly signed with the affected accounts' private keys, the exact technical vulnerability that allowed the keys to be compromised remains undisclosed. The investigation revealed that a significant portion of the victims had interacted with the D’CENT mobile app, particularly versions released prior to a recent critical update.
Asset Dispersion and Mitigation Steps
Once the funds were consolidated, the attackers moved the stolen assets through various channels to complicate recovery efforts. Over 5.6 million XRP was routed through THORChain, while other portions were sent to NEAR Intents, Binance, and unionchain.ai. D’CENT is currently collaborating with international law enforcement and security specialists to freeze the stolen assets where possible, though no recoveries have been confirmed yet. The company has issued an urgent advisory for users to migrate their assets to entirely new wallets with fresh recovery phrases, especially if their original phrases were ever entered into the mobile application.
Safeguarding Future Assets
In response to the ongoing threat, D’CENT has emphasized that simply moving funds back to a hardware device using an old recovery phrase is insufficient. Users are instructed to update their software to the latest version and generate a completely new private key to ensure their assets are no longer exposed. Additionally, the company warned the community to remain vigilant against impersonators and phishing attempts that often follow such high-profile exploits. Holders are reminded that legitimate support staff will never ask for private keys, PINs, or recovery phrases under any circumstances.
