XRP coins streaming from a damaged digital wallet vault after a wallet security incident

11.75 Million XRP Drained From 6,678 D’CENT App Wallets Across Six Waves

By Isaac • September 23, 2026 3:42 pm • Comments

A six-day series of unauthorized transfers removed nearly 11.75 million XRP from 6,678 wallets tied to D’CENT’s software-based App Wallet, according to a detailed reconstruction of the XRP Ledger.

The numbers are large, but the transaction pattern is the more important part of the story. The funds did not disappear in one blunt sweep.

The operator moved through six waves, used multiple collection addresses, and later deleted thousands of accounts to capture XRP that normal payments could not remove.

Trending: XRP Jumps to $1.60 as CME Shorts Collapse—but Coinbase Traders Barely Move

XRPL.to’s ledger analysis counted 11,746,198 XRP taken between September 15 and September 20. It found 4,208 wallets that were swept and another 2,470 that were deleted with whatever balance remained, for 6,678 affected wallets in all.

The AccountDelete trail matters. An XRP Ledger account has to hold a reserve.

A standard payment can empty most of a wallet, but it cannot take that reserve. The AccountDelete transaction removes the account itself and sends the remaining reserve to another address.

The analysis found 5,001 account deletions. That included 1,525 wallets already emptied in the first wave and 2,470 wallets that had not been swept first. One of those whole-account deletions carried 107,507 XRP.

That pattern is strong evidence that the operator possessed the private keys needed to sign transactions. It is not evidence of how those keys were obtained.

The ledger records what a key authorized, not whether the key was exposed through malware, a compromised service, user error, or some other route.

Funds moved off the XRP Ledger quickly. The on-chain reconstruction says 5,594,530 XRP was routed through THORChain and swapped to Ethereum.

Another 3,241,519 XRP went to unionchain.ai, while smaller amounts moved through NEAR Intents and Binance deposit tags. At the analysis cutoff, about 1.31 million XRP remained in wallets controlled by the operator.

The first wave began with large wallets handled individually before an automated process started. That process initially miscalculated the reserve for wallets with trust lines or other ledger objects.

After a pause, it returned with corrected reserve arithmetic and continued down the list. The same code pattern appeared again days later.

CryptoSlate put the dollar value near $20 million and emphasized that the activity stretched across multiple attack waves rather than one isolated event. The exact dollar value moves with XRP’s market price; the ledger-denominated total is the firmer measure.

What App Wallet users should take from it. D’CENT told App Wallet users to update the app, use its check to determine whether action was required, and move assets when prompted.

That warning applies to the software App Wallet; it should not be casually broadened into a claim about every D’CENT product or every XRP wallet.

The key distinction is between confirmed transaction evidence and an unconfirmed intrusion cause. The ledger can show that valid keys signed payments and deletions.

Until an investigation establishes how those keys became available, claims about the initial compromise remain theories, not findings.


Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews