The year’s second-largest XRP hack is spilling over to Bitcoin and Ethereum

The D’CENT wallet hack, the year’s second-largest drain of XRP behind the Bitget crypto exchange hack, has spilled beyond the XRP Ledger onto additional blockchains like Bitcoin, Ethereum, and Stellar. 

Hackers have drained more than 12.4 million XRP from more than 7,000 D’CENT wallets, still some way behind Bitget’s loss of 102.9 million XRP.

Although the wallet was popular among the XRP community, D’CENT users who owned assets of other blockchains have also lost their funds.

D’CENT’s own disclosure named Bitcoin, Tron, and Ethereum, for example. Even a Stellar user has lost XLM in the incident.

Hackers are able to sweep funds across blockchains with one compromised recovery phrase for the multi-blockchain wallet.

IoTrust, the maker of D’CENT, confirmed at least 110 abnormal transfer reports, including non-XRP assets, per ZDNet Korea.

Status report on unauthorized asset transfers in the DCENT App Wallet

We recognize the serious concern this issue has caused. This report is based on the facts confirmed as of September 17, 2026.

The latest DCENT app includes a check to help determine whether action may be… pic.twitter.com/k1DUKKDMYX

Drains of XRP are the most well-documented, due to the prominence of D’CENT among XRP holders.

At least six waves of theft occurred between September 15 and 20, emptying 6,678 wallets of 11.7 million XRP.

The thief stole from large wallets first, by hand, and soon wrote scripts to take funds from progressively smaller wallets.

Warnings from D’CENT and other members of the XRP community couldn’t stop the drainage. Thieves took 640,370 additional XRP after September 21, bringing the tally to above 12.4 million.

By Friday, 6.3 million of those stolen XRP had crossed to Ethereum’s blockchain through the swap service THORChain.

As the theft spilled over to other blockchains, researchers admitted the scope of the losses, saying, “Most of it is no longer XRP.”

Read more: David Schwartz warns of hard fork because XRP nodes won’t upgrade

In August, D’CENT was still touting its hardware wallets’ secure element, boasting that it was impervious to vulnerabilities linked to the Coldcard hack.

D’CENT now warns users that wallets they created using its app are vulnerable, urging them to create a fresh recovery phrase and immediately migrate everything, including tokens, NFTs, and any staked assets.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

The post The year’s second-largest XRP hack is spilling over to Bitcoin and Ethereum appeared first on Protos.