A security breach affecting older versions of the D'CENT App Wallet resulted in the theft of approximately 12.4 million XRP, or 12,402,589 XRP, from 7,393 XRP Ledger wallets between Sept. 15 and Sept. 25. Attackers exploited compromised private keys, draining about 3.6 million XRP from 1,682 wallets in less than three hours during the first wave and stealing more than 640,000 XRP after Sept. 21 despite public warnings. On-chain analysis found that 6,095 accounts had been deleted entirely. About 6.3 million XRP had been moved through cross-chain swaps into Ethereum using THORChain, with some funds subsequently routed to centralized exchanges including Binance; approximately 1.4 million XRP remained in monitored attacker-controlled addresses as of Sept. 25. The vulnerability appears linked to private-key handling in D'CENT App versions older than 8.1.0, released Nov. 5, 2025, although D'CENT has not disclosed the precise compromise mechanism. Hardware wallets were not affected by the software-side attack unless users had imported or restored their recovery phrases in the compromised app. D'CENT is working with law enforcement to trace and freeze the funds and has warned users not to send XRP to old wallet addresses or reuse recovery phrases entered into affected app versions. Users should update through official app stores and move assets to newly created wallets. Earlier warnings also covered fake D'CENT emails promoting a malicious Slack download for macOS.