Investor Loses $100,000 in XRP and XLM as D’CENT Wallet Drain Continues

The D’CENT app wallet drain has continued into its seventh day, with another XRP community member losing more than $100,000 in XRP and XLM. 

The most recent case follows an earlier report that confirmed the attackers had initially drained 2 million XRP during the Sept. 15 event, with further investigation now uncovering more victims.

The latest victim lost funds on both the Stellar blockchain and the XRP Ledger (XRPL). 

On Stellar, the victim’s address, GDTO…E356, was triggered to create the account GAVT…37GU at 03:38 UTC on Sept. 23 and send 17,244 XLM, worth more than $3,600, to it. Notably, the attackers controlled the newly created account.

About four hours after receiving the XLM, the hackers moved the tokens to Changelly. However, the Stellar transaction made up only a small part of the victim’s total loss, as most of the stolen funds came from his XRP holdings.

More Than 75,000 XRP Drained

On the XRPL, the victim’s XRP account, rU6m…Ppcc, was triggered to create the attacker-controlled account rLbQ…SiPc at 04:36 UTC on Sept. 23. The victim’s account then sent 72,521 XRP, worth more than $117,000, to the hacker-controlled wallet.

Around 30 minutes later, the attackers took another 2,488 XRP, worth about $4,000, leaving the victim’s wallet empty. The attackers moved the roughly 75,000 XRP to two different wallets about five hours after receiving the funds.

The stolen XRP later moved through several transactions, with some of the funds eventually reaching Binance. As the latest attack happened only hours before this report, the transactions show that the attackers have continued to actively target and drain wallets.

Attack Began With 1,682 XRPL Wallets

The broader drain campaign started on Sept. 15, 2026, when attackers emptied 1,682 XRP Ledger wallets between 15:35 and 18:55 UTC. The stolen funds went to seven addresses and marked the first wave of six identified in the campaign.

By the evening of Sept. 20, the same operator had continued the attack using the same script and the same by-hand tool. By then, the attackers had emptied 6,678 wallets and taken a total of 11.7 million XRP.

The attackers also deleted 5,001 accounts, most of which had already been emptied. They recovered the reserve held by each deleted account and later swapped 5.6 million XRP for Ethereum. 

D’CENT has responded by telling users of its app wallets to move all their assets out of the wallets. The latest victim’s losses confirm that the campaign has continued well beyond its initial activity on Sept. 15.