XRP Wallet Drain: What Happened to D'CENT App Users, and Is Yours Safe?

Between September 15 and 20, 2026, at least 11.7 million XRP was drained from 6,678 wallets in six waves. According to the video, that was close to $20 million at that week’s prices. By September 25, one chain tracker put the total at around 12.4 million XRP from more than 7,300 wallets.

The XRP Ledger itself was not hacked. Every one of those transactions was signed with the wallet owner’s own private key. Somebody had the keys. If you hold XRP in any kind of wallet, here is what happened, where the coins went, whether any can come back, the scam that follows attacks like this, and a two-minute check you can do on your own setup.

What happened to the D’CENT wallets?

The drained wallets belonged to people who used the D’CENT app wallet, the phone app from a South Korean company that makes hardware wallets. According to an on-chain analysis site cited in the video that rebuilt the attack from the ledger, the first wave hit on September 15.

The attacker started by hand. Eight of the largest wallets, each holding around 100,000 XRP or more, were emptied manually before any automated script ran. Then the script took over:

1. Wave one (September 15): 1,682 wallets were emptied in a little over three hours.
2. Waves two to six: five more waves followed over the next five days.
3. Clean-up: every XRP Ledger account must hold a small reserve just to exist, so the attacker deleted more than 5,000 emptied accounts to collect that reserve too.

Some wallets were emptied, refilled and emptied again. The keys were still compromised, so anything sent to those old addresses was taken. From the outside, a compromised wallet looks normal until the moment it doesn’t.

Was it a flaw in the XRP Ledger?

No. The ledger did exactly what it was designed to do: it checked each signature, found a valid key and processed the payment.

D’CENT said its hardware wallets were not the origin. The affected users were app wallet users, plus hardware wallet owners who at some point typed their hardware wallet’s recovery phrase into the app wallet. As of September 25, 2026, D’CENT had not published how the keys were exposed, so the video says anyone claiming to know the exact cause is guessing.

The hardware wallet detail still matters. A hardware wallet keeps your keys offline. The moment you type the recovery phrase into a phone or computer, it is no longer offline. In a clip shown in the video, Ledger’s support team gives the rule plainly: do not type your phrase into a password manager, do not photograph it, do not type it into a computer, and do not create any digital copy. Anyone trying to learn your recovery phrase should be treated as a scammer.

Where did the stolen XRP go?

It moved fast and in several directions. By September 21, according to the trace cited in the video:

Destination	Approximate amount	Notes
THORChain	5.6 million XRP	Almost all with instructions to swap into Ethereum
A second service	3.24 million XRP	Described by the analysts as an exchange
Binance deposit tags	About 536,000 XRP	Exchange deposits

The video stresses that none of these services is accused of anything. They are simply where the trail leads.

This matters because once XRP is swapped into another coin on another blockchain, getting it back means chasing it across systems with different owners, rules and countries. THORChain lets people swap across blockchains without handing over ID. According to the video, it was also the route used after North Korean hackers stole about $1.5 billion from the exchange Bybit in February 2025, the largest crypto theft on record. Elliptic, a blockchain analytics firm, compares this “chain hopping” to a criminal swapping dollars into yen and then into Singapore dollars at different money changers to hide where the money came from.

Can stolen XRP be recovered?

Some of it might come back. Most of it probably won’t. Stablecoins such as Tether’s USDT and Circle’s USDC can be frozen by the companies that issue them. XRP has no issuer that can freeze it, and Elliptic explains in the video that thieves often swap freezable coins into non-freezable ones immediately for that reason.

With XRP, the realistic chance of recovery comes when stolen funds touch an exchange that knows its customers and can block an account. Nobody can press a button on the ledger and reverse a payment. Speed is the victim’s best hope.

D’CENT said it is working with Korean police, security specialists and exchanges to trace the funds and request freezes. As of September 25, 2026, no freeze or recovery had been publicly confirmed.

History is sobering. After the Bybit theft, Elliptic’s Tom Robinson told CNBC that very little has been recovered when North Korea is involved. But public ledgers cut both ways: tracing is possible, and funds that are still visible can still be seized. TRM Labs’ Ari Redbord describes the Beacon Network in the video, which links exchanges and fintechs (he names Kraken, OKX, Crypto.com, Ripple, Stripe, Robinhood and PayPal among others) with about 70 law enforcement agencies. When agencies flag an address carrying stolen funds, members are expected to block it and work to seize the funds.

Watch for the second scam: fake recovery help

After an attack like this, scammers target victims and anyone frightened. They pose as the wallet company’s support team, promise to help recover funds, then ask for a recovery phrase or a payment.

According to the video, D’CENT’s support pages say it will never ask for recovery words and will never contact you first through Telegram or social media. While researching, the video’s team found web pages advertising so-called official D’CENT support phone numbers that did not belong to D’CENT.

Trezor warns in a clip that scam emails use subject lines built on fear and urgency, such as “security incident” or “critical vulnerability,” and link to impostor sites. The FBI says it may contact victims, but it will never ask for money, never move the conversation to a private messaging app and never request bank details. Hold every so-called helper to that standard.

The two-minute recovery phrase check

The video’s check, done with pen and paper rather than a notes app:

1. Write down every place you have ever typed, pasted or photographed your recovery phrase: every app, website, cloud backup and screenshot.
2. If the list has anything on it, the phrase is no longer truly offline.
3. If you used the D’CENT app wallet, or typed a hardware wallet phrase into it, follow D’CENT’s advice: update the app, set up a new wallet with a brand-new recovery phrase, move your funds into it and never send anything to the old address again.
4. If your phrase was typed anywhere else, the same principle applies. An exposed phrase should be retired, not just protected harder.

If you have already been hit

Report it quickly. In the US, that is the FBI’s IC3. In England, Wales and Northern Ireland, it is Report Fraud, the service that replaced Action Fraud. In Scotland, contact Police Scotland on 101. Elsewhere, contact your national police. The FBI says the most useful details are wallet addresses, email addresses, phone numbers, usernames and transaction IDs. As Elliptic notes, a few minutes can decide whether funds get frozen at an exchange.

What to keep in perspective

The video does not argue against self-custody. It cites a figure of $158 billion in crypto crime in 2025, a record, which still made up only about 1.3% of crypto activity. In this case the weak point was not the XRP Ledger or self-custody as an idea, but keys ending up somewhere they shouldn’t.

Going forward, watch for D’CENT’s explanation of how the keys were exposed and for any confirmed freezes. Until then, the rule is simple: your recovery phrase is your money. Keep it on paper, offline, and never typed.