A signing flaw in D'CENT's App Wallet software let attackers drain 9.3 million XRP — over $9 million — from 6,160 addresses in mid-September, according to on-chain tracking by the XRPL intel service, with Startup Fortune and U.Today reporting the figures.
The attackers worked methodically. On-chain records reviewed by The Crypto Basic show the drain beginning at 16:29 UTC with a small test transfer — 9 XRP moved from a wallet holding 10 — before scaling up: in one two-hour window alone, 1,552 wallets were hit for roughly 2 million XRP. Of the 9.3 million XRP tracked, about 2 million sits in identified attacker wallets while roughly 7 million has been mixed with funds from other sources, complicating recovery and tracing.
D'CENT has urged users to update to App Wallet v10.0.0 and move assets to a secure wallet, with users who entered their recovery phrases into the app flagged as especially at risk, per Coin-Turk. The company has not confirmed a compromise of its hardware products and continues to investigate the cause and total scope. Its stated exposure criteria, as summarized by CryptoSlate, are wallets whose recovery phrases were entered into the App Wallet and that had transaction-signing history on versions earlier than 8.1.0, released November 5, 2025 — with potential exposure spanning Bitcoin, Ethereum, XRP Ledger, Tron and other EVM-compatible networks.
The Takeaway
The incident is a reminder that "hardware wallet" security is only as strong as the surrounding software surface. A seed phrase that has ever been typed into a phone — any phone, for any reason — has already left the hardware's trust boundary. D'CENT's own criteria draw that line precisely: the victims are the users whose keys existed in software memory, not those whose keys never left the device.
For users, the guidance is the same the XRPL trackers and the vendor are giving: update, then migrate to a freshly generated seed on a clean device — because a compromised phrase cannot be patched, only replaced.
TrustGrade tracks the security posture of wallet vendors, protocols, and exchanges. Verified trust data: trustgrade.ai.