D'CENT Wallet Hack Steals Over 12.4 Million XRP from 7,000 Users

A D'CENT wallet hack has stolen over 12.4 million XRP from more than 7,000 users. This is the second largest XRP theft of 2026.

Key Points

• More than 12.4 million XRP stolen from over 7,000 D'CENT wallets, the second largest XRP theft of 2026 after the Bitget exchange hack.
• The theft extended to other blockchains: Bitcoin, Ethereum, Tron, and Stellar, with losses also in XLM.
• At least six waves of thefts between September 15 and 20 emptied 6,678 wallets of 11.7 million XRP.
• 6.3 million XRP were transferred to the Ethereum blockchain via the THORChain swap service.
• D'CENT urges all users to create a new recovery phrase and immediately migrate any assets.

Scope and Scale of the D'CENT Hack

The attack on the D'CENT wallet ranks second in size among XRP thefts of 2026, only behind the heist suffered by the Bitget exchange, which lost 102.9 million XRP. Here, the damages remain substantial but still enormous: over 12.4 million XRP vanished from more than 7,000 wallets.

Details on the XRP Theft

The wallet was particularly popular among XRP holders, and indeed the data on withdrawals of this token is the most documented. But it doesn't stop there.

Spread Beyond XRP to Other Blockchains

Those who held assets from other networks in the wallet also lost them. D'CENT itself cited Bitcoin, Tron, and Ethereum among the affected blockchains. A Stellar user also reported the loss of their XLM. IoTrust, the company behind D'CENT, confirmed at least 110 reports of unusual transfers, including those related to assets other than XRP.

Timing and Method of the Theft

The mechanism behind the multi-chain theft is as simple as it is dangerous: a single compromised recovery phrase is enough to empty wallets across different blockchains.

Waves of Theft Between September 15 and 20

At least six waves of withdrawals were recorded between September 15 and 20, which emptied 6,678 wallets totaling 11.7 million XRP. The thieves initially targeted the largest wallets manually before switching to automated scripts capable of progressively draining even smaller wallets. Warnings issued by D'CENT and the XRP community were not enough to stop the bleeding: after September 21, another 640,370 XRP were stolen, bringing the total above 12.4 million.

Use of a Compromised Recovery Phrase for Multi-Chain Theft

As a multi-blockchain wallet, a single compromised recovery phrase allowed attackers to simultaneously target multiple networks linked to the same account. This explains why the damage was not limited to XRP.

Movement of Assets and Consequences

A significant portion of the loot has already changed blockchains, making it more difficult to trace and recover the funds.

Asset Migration via THORChain

By Friday, 6.3 million of the stolen XRP had already passed onto the Ethereum blockchain through the THORChain swap service. Some researchers noted that much of the loot is no longer traceable to XRP, having been converted into other assets along the way.

Impact on Non-XRP Assets and Multi-Chain Losses

Reports of unusual transfers collected by IoTrust confirm that the vulnerability of the D'CENT wallet also involved assets other than XRP, worsening the overall picture of losses across multiple networks.

Security Warnings and User Advice

D'CENT is now asking all users to consider their wallets compromised and to act immediately, without waiting for further confirmations.

D'CENT Warning on Wallet Vulnerability

Just last August, D'CENT boasted that its secure element was immune to vulnerabilities related to the Coldcard case. Today that security appears compromised: the company warns that all wallets created through its app are at risk.

Urgency to Create New Recovery Phrases and Migrate Assets

D'CENT urges users to generate a new recovery phrase and to immediately migrate all assets, including tokens, NFTs, and any funds in staking. Those who do not do so remain exposed: the vulnerability has already been exploited across multiple blockchains, and there remains a risk that new waves will hit those who have not yet moved their funds.

FAQ

How much XRP was stolen in the D'CENT wallet hack?

Over 12.4 million XRP were stolen from more than 7,000 D'CENT wallets.

Did the attack also affect other cryptocurrencies besides XRP?

Yes, the theft extended to other blockchains, including Bitcoin, Ethereum, Tron, and Stellar, with reported losses also in XLM.

How did the hackers manage to steal funds across multiple blockchains simultaneously?

The attackers used a single compromised recovery phrase linked to the D'CENT multi-blockchain wallet to empty accounts on different networks.

What does D'CENT advise users to do after the attack?

D'CENT urges all users to create a new recovery phrase and to immediately migrate all assets, including tokens, NFTs, and staking funds.