D'CENT's app wallet lost 2,009,321 XRP to two addresses that did not exist yet
Two addresses that did not exist when the drain began took 2,009,321 XRP from 1,552 D'CENT app wallets.
On 15 September, 1,552 D’CENT app-wallet holders lost 2,009,321 XRP to two addresses that did not exist when the drain began.[1][2]
The first script paused on miscalculated XRP Ledger reserves, and the attacker drained the biggest wallets by hand: 730,954 XRP at one new address.[3][4]
The revised script ran next, and took another 1,258,563 XRP from the wallets that had not moved yet.[5]
By the next day, 1.8 million XRP of the stolen total sat in attacker-controlled wallets, and D’CENT’s advice to move funds had gone out hours after the sweep.[6][7]
Who gains, who loses
Receipts
On 15 September 2026, between 16:29 and 18:34 UTC, attackers drained 1,552 XRP Ledger wallets of a total of 2,009,321 XRP using two addresses that did not exist when the attack began.
“On 15 September 2026, between 16:29 and 18:34 UTC, 1,552 XRP Ledger wallets lost 2,009,321 XRP to two addresses that did not exist when it began.”
Between 16:29 and 18:34 UTC on 15 September 2026, attackers drained 1,552 D’CENT wallets and took a total of 2,009,321 XRP, worth over $2.8 million at the time.
“Notably, between 16:29 and 18:34 UTC, a period of just two hours and five minutes, attackers drained 1,552 wallets and took a total of 2,009,321 XRP, worth over $2.8 million at the time.”
On-chain analysis shows that the Descent attack’s first phase began at 4:29 p.m. on 15 September 2026, draining 19,787 XRP from 204 wallets in about 14 minutes before the script paused after recording 72 failed attempts due to miscalculated XRP Ledger reserves.
“The first attack began at 4:29 p.m.”
During a roughly 33‑minute pause in the automated attack on 15 September 2026, the attacker manually drained the top 12 wallets holding more than 42,000 XRP each, accumulating 730,954 XRP at a single new address by 5:13 p.m.
“The automated script was paused for about 33 minutes, and during that time the attacker moved funds directly from the top 12 wallets holding more than 42,000 XRP.”
From 5:17 p.m. to 6:34 p.m. on 15 September 2026, the revised automated script in the Descent attack stole an additional 1,258,563 XRP from 1,336 wallets at a processing speed of about 17.6 accounts per minute.
“From 5:17 p.m., the revised automated script ran again.”
Hours after the 15 September 2026 event, D’CENT warned users to move their funds immediately and said the incident appeared to affect only its software-based App Wallet and not its hardware devices.
“Hours after the event, D’CENT warned users to move their funds immediately.”
By 16 September 2026, about 1.8 million XRP of the roughly 2 million XRP stolen in the Descent app wallet attack remained in attacker-controlled wallets, while about 236,000 XRP had been moved to exchanges or bridge services.
“As of Sept. 16, about 1.8 million XRP of the roughly 2 million XRP stolen remained in attacker-controlled wallets, while the amount moved to exchanges or bridge services was about 236,000 XRP.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.