D'CENT App Wallet Breach Drains Millions in XRP Across Thousands of Accounts

Scale and Timeline of the Breach

XRPL.to traced six distinct attack waves draining XRP from 6,678 wallets through September 20, while Crypto Briefing reported 12.4 million XRP stolen over a ten-day period. CryptoSlate's reporting suggests a higher total of nearly $20 million in drained assets, indicating either a wider scope or different valuation timeframe than the Crypto Briefing figure. The breach exposed a fundamental vulnerability in D'CENT's app wallet, though the precise attack vector and duration remain under investigation.

D'CENT's Response and Seed Rotation Warning

D'CENT issued an advisory requiring users with exposed recovery phrases to rotate their seed phrases immediately. The company emphasized that the risk extends beyond software wallets: even users who had migrated their exposed seeds to hardware wallets remain vulnerable, as the compromised phrase itself can be used to derive private keys regardless of storage method. This advisory underscores that seed compromise represents an irreversible security event — relocation alone does not eliminate the threat.

Industry Implications

The incident highlights the persistent gap between hardware wallet security and app wallet custody. While hardware devices protect against malware on a user's computer, they cannot protect against compromised recovery phrases, which represent direct access to all derived accounts. The breach's scale and multi-wave pattern suggest attackers may have gained access to D'CENT's systems or user backup mechanisms rather than targeting individual devices, a distinction with serious implications for app-based custody models.