A security breach affecting D’CENT wallets has spread beyond XRP and into several other blockchain ecosystems, after attackers used compromised recovery phrases to drain funds from the multi-chain wallet. The incident has already become this year’s second-largest XRP theft, trailing only the Bitget exchange hack.
More than 12.4 million XRP has been stolen from over 7,000 D’CENT wallets, according to reporting cited by researchers and disclosures from IoTrust, the wallet maker. The company has also confirmed at least 110 reports of abnormal transfers involving assets other than XRP.
Losses spread across multiple chains
The thefts were first most visible on the XRP Ledger because D’CENT had a strong following among XRP holders. But the same recovery phrase could control assets on multiple networks, allowing attackers to sweep funds held on other chains as well.
IoTrust has identified Bitcoin, Tron, and Ethereum among the affected networks, while at least one Stellar user also lost XLM. Researchers said the scale of cross-chain losses means the incident can no longer be viewed as only an XRP theft.
How the drain unfolded
According to the source reporting, at least six waves of theft took place between September 15 and September 20. During that period, 6,678 wallets were emptied of 11.7 million XRP.
The attacker reportedly began by manually targeting larger wallets before moving to automated scripts that drained progressively smaller balances. Community warnings and alerts from D’CENT did not stop the outflows. After September 21, thieves took another 640,370 XRP, pushing the total above 12.4 million XRP.
Funds moved off XRP
By Friday, 6.3 million of the stolen XRP had already been bridged to Ethereum through the swap service THORChain. That movement made it harder to characterize the stolen assets as remaining primarily on XRP, and researchers acknowledged that much of the haul had already shifted elsewhere.
The value of the XRP stolen was described as roughly $18 million in the source material. That still leaves the D’CENT incident well below the 102.9 million XRP attributed to the Bitget hack, but large enough to rank as the year’s second-biggest XRP drain.
D’CENT’s response and the next step for users
The breach is especially notable because D’CENT had recently promoted the security of its hardware wallets, including claims in August about protection offered by their secure element. IoTrust now says wallets created through its app are vulnerable.
The company is urging affected users to generate a completely new recovery phrase and move all holdings immediately. Its warning applies not only to coins and tokens, but also to NFTs and any staked assets tied to wallets created in the app.
Source: protos.com