D'CENT Wallet Hack Spills Over to Bitcoin and Ethereum
Major XRP wallet breach expands to other chains
A significant security incident involving D'CENT wallets has resulted in the theft of more than 12.4 million XRP. This event marks the second-largest XRP hack of the year, trailing only a recent breach at the Bitget exchange. The compromise has extended beyond the XRP Ledger, affecting assets on Bitcoin, Ethereum, and Stellar blockchains.
D'CENT is a hardware wallet provider, which refers to physical devices used to store cryptocurrency offline. The breach impacts users who held various digital assets within the D'CENT app wallet.
Scope of the theft across multiple networks
- Over 12.4 million XRP were drained from more than 7,000 wallets.
- The total loss is less than the 102.9 million XRP taken in the Bitget hack earlier this month.
- Funds were stolen from Bitcoin, Tron, Ethereum, and Stellar (XLM) accounts.
- Hackers utilized a single compromised recovery phrase to access funds across different blockchains.
- At least 110 abnormal transfer reports were confirmed by IoTrust, the maker of D'CENT.
Timeline of the attack waves
The theft occurred in at least six waves between September 15 and September 20. During this period, 6,678 wallets were emptied of 11.7 million XRP. Attackers initially targeted larger wallets manually before deploying automated scripts to drain progressively smaller accounts.
Despite warnings issued by D'CENT and community members, the drainage continued. An additional 640,370 XRP were taken after September 21, pushing the total above 12.4 million. By September 27, approximately 6.3 million of the stolen XRP had been moved to the Ethereum blockchain via the THORChain swap service.
Official response and user guidance
IoTrust confirmed the incidents in a status report dated September 17, 2026. The company acknowledged that the issue caused serious concern for users. In August, D'CENT had promoted its hardware wallets as secure and resistant to certain vulnerabilities, but the current situation indicates otherwise.
D'CENT is now advising users that wallets created using their app are vulnerable. The company urges affected individuals to generate a new recovery phrase immediately. Users are instructed to migrate all assets, including tokens, non-fungible tokens (NFTs), and staked items, to a secure location.
Current status of stolen funds
While the initial focus was on XRP, researchers noted that much of the stolen value has been converted or moved to other chains. One researcher stated that "most of it is no longer XRP." The exact final destination of all funds remains unclear as the movement continues across various networks.
Source
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Strategy’s $13,400 Bitcoin floor reveals loss order in its debt structure
U.S. Treasury targets Iran’s crypto sector in expanded sanctions
