D'CENT app wallet attack drains 12.4M XRP from users

by@martypartymusic

Summary

As of September 25, 2026, the ongoing attack on the D’CENT App Wallet has resulted in the draining of approximately 12.4 million XRP from 7,393 wallets, with attackers exploiting valid signatures from previously compromised keys rather than any protocol vulnerability in the XRP Ledger. The attack commenced on September 15 and has involved multiple waves, leading to account deletions and a significant amount of XRP being swapped for Ethereum. D’CENT, the wallet's provider, has clarified that the issue is confined to the software App Wallet and has not affected their standalone hardware. Users are urged to take precautionary measures, including avoiding the restoration of old recovery phrases and only updating the app from official sources, amidst ongoing investigations by Korean law enforcement and industry analysts to uncover the root cause of the breach.

Tokens

$XRP$ETH$BTC

Analysis

XRP: XRP is the native asset of the XRP Ledger used for payments and reserves. In the reported attack, millions of XRP tokens have been drained from thousands of D'CENT app wallet addresses through valid but compromised signatures, with portions swapped or moved onward. TRON: TRON is a blockchain platform supporting decentralized applications and token transfers. It is listed among the networks where compromised keys from the D'CENT app have enabled unauthorized activity. USDT: USDT is a widely used stablecoin issued on multiple blockchains. It is referenced as an example token that could be impacted by the same compromised keys across EVM-compatible chains in the D'CENT incident. D'CENT: D'CENT is a multi-chain cryptocurrency wallet brand offering a software app and hardware devices, developed by IoTrust. The ongoing incident involves active draining of its app wallet users' funds across multiple blockchains via compromised keys, with the company confirming the vulnerability is isolated to the app and not standalone hardware unless recovery phrases were previously imported into the app. Bitcoin: Bitcoin is the original cryptocurrency and blockchain focused on peer-to-peer electronic cash. It is among the chains affected by the key compromise in the D'CENT app wallet drain. IoTrust: IoTrust operates the D'CENT wallet ecosystem and is coordinating with Korean law enforcement, exchanges, and analysts on the active app wallet drain investigation. The company has issued guidance limiting the issue to app usage and specific signing history on older versions. Ethereum: Ethereum is a programmable blockchain network supporting tokens and smart contracts. Drained assets from the D'CENT wallet incident have been directed to it via swaps and other flows. THORChain: THORChain is a decentralized cross-chain liquidity protocol enabling native asset swaps. Attackers in the D'CENT incident have routed drained XRP through it toward Ethereum and other destinations. User Impact: Users are advised to avoid restoring old recovery phrases, update the app from official stores, create new wallets, move all assets, and revoke approvals. Attack Nature: The drain relies on valid signatures from already-compromised keys rather than any XRP Ledger protocol vulnerability. Investigation Status: Root cause details remain undisclosed to avoid copycats, with ongoing probes by Korean authorities and industry partners.

Categories

ripplecryptoethereumdefihyperliquidon_chain_whale
View Original Tweet