@Xaif_Crypto I had multiple wallets on my ledger and he told me to put it all in one wallet... I copied the addresses straight from the app but they never ended up in the right wallet... I know... Stupid
Detailed follow-up / thread draft
I lost $100k+ in XRP and XLM. Here are the facts so far.
Stellar (XLM) drain
Transaction: https://t.co/jNgjbok7mE
Time: 23 Sep 2026, 03:38:03 UTC
Status: Successful
Operation: create_account
Amount sent to the new account: 17,244.391065 XLM (~$3,700 at ~$0.216)
Fee: 0.00001 XLM
This is a classic sweep: the source account used its own keys to fund a fresh destination account.
XRP Ledger drain
Transaction: https://t.co/2Wgw46hsGy
This is the bulk of the loss. Combined with the XLM movement it is well over $100k at current prices (XRP ~$1.60).
Context
This matches the pattern of the D’CENT App Wallet unauthorized transfers that started 15 Sep 2026. On-chain tracking has shown multiple waves totaling ~11.7 million XRP from 6,000+ wallets whose recovery phrases had been entered into the D’CENT software App Wallet (versions before 8.1.0). D’CENT has said hardware wallets themselves are not confirmed compromised, but anyone who imported a seed into the App Wallet is exposed. D’CENT supports both XRPL and Stellar, so both assets can leave the same compromised key.
https://t.co/6GvIpgLtIH
D’CENT first flagged abnormal transfers on 16 Sep, told users to update the app and move funds to new recovery phrases, and said they are working with Korean law enforcement and asking exchanges to freeze funds. Some drains have continued after the main waves as remaining keys are used.
What I am asking
@chainalysis@trmlabs@DOJFraudDiv@XRPLF@StellarOrg@DCENTWALLETS
Please review these two transactions, identify the destination / collector addresses, and help flag or freeze any funds that have not yet been swapped off-chain (prior D’CENT waves used THORChain, https://t.co/sMMR0FW0JM, NEAR Intents, Binance tags, etc.).
I did not share my seed phrase with anyone. I am posting the explorer links so the movement can be verified independently.
Warning to anyone reading this
Do not DM me offering “recovery,” “whitelist,” or “private investigator” services. Those are scams that target people who just posted a loss. I will only work through official channels or well-known on-chain analysts.
If you have been hit in the same D’CENT App Wallet wave, document your tx hashes the same way and report to D’CENT + local law enforcement. Generate a brand new recovery phrase on a device that never touched the old App Wallet before moving anything remaining.
Thank you to anyone who can help trace this.
@allthemoney
Detailed follow-up / thread draft
I lost $100k+ in XRP and XLM. Here are the facts so far.
Stellar (XLM) drain
Transaction: https://t.co/jNgjbok7mE
Time: 23 Sep 2026, 03:38:03 UTC
Status: Successful
Operation: create_account
Amount sent to the new account: 17,244.391065 XLM (~$3,700 at ~$0.216)
Fee: 0.00001 XLM
This is a classic sweep: the source account used its own keys to fund a fresh destination account.
XRP Ledger drain
Transaction: https://t.co/2Wgw46hsGy
This is the bulk of the loss. Combined with the XLM movement it is well over $100k at current prices (XRP ~$1.60).
Context
This matches the pattern of the D’CENT App Wallet unauthorized transfers that started 15 Sep 2026. On-chain tracking has shown multiple waves totaling ~11.7 million XRP from 6,000+ wallets whose recovery phrases had been entered into the D’CENT software App Wallet (versions before 8.1.0). D’CENT has said hardware wallets themselves are not confirmed compromised, but anyone who imported a seed into the App Wallet is exposed. D’CENT supports both XRPL and Stellar, so both assets can leave the same compromised key.
https://t.co/6GvIpgLtIH
D’CENT first flagged abnormal transfers on 16 Sep, told users to update the app and move funds to new recovery phrases, and said they are working with Korean law enforcement and asking exchanges to freeze funds. Some drains have continued after the main waves as remaining keys are used.
What I am asking
@chainalysis@trmlabs@DOJFraudDiv@XRPLF@StellarOrg@DCENTWALLETS
Please review these two transactions, identify the destination / collector addresses, and help flag or freeze any funds that have not yet been swapped off-chain (prior D’CENT waves used THORChain, https://t.co/sMMR0FW0JM, NEAR Intents, Binance tags, etc.).
I did not share my seed phrase with anyone. I am posting the explorer links so the movement can be verified independently.
Warning to anyone reading this
Do not DM me offering “recovery,” “whitelist,” or “private investigator” services. Those are scams that target people who just posted a loss. I will only work through official channels or well-known on-chain analysts.
If you have been hit in the same D’CENT App Wallet wave, document your tx hashes the same way and report to D’CENT + local law enforcement. Generate a brand new recovery phrase on a device that never touched the old App Wallet before moving anything remaining.
Thank you to anyone who can help trace this.
@allthemoney
Detailed follow-up / thread draft
I lost $100k+ in XRP and XLM. Here are the facts so far.
Stellar (XLM) drain
Transaction: https://t.co/jNgjbok7mE
Time: 23 Sep 2026, 03:38:03 UTC
Status: Successful
Operation: create_account
Amount sent to the new account: 17,244.391065 XLM (~$3,700 at ~$0.216)
Fee: 0.00001 XLM
This is a classic sweep: the source account used its own keys to fund a fresh destination account.
XRP Ledger drain
Transaction: https://t.co/2Wgw46hsGy
This is the bulk of the loss. Combined with the XLM movement it is well over $100k at current prices (XRP ~$1.60).
Context
This matches the pattern of the D’CENT App Wallet unauthorized transfers that started 15 Sep 2026. On-chain tracking has shown multiple waves totaling ~11.7 million XRP from 6,000+ wallets whose recovery phrases had been entered into the D’CENT software App Wallet (versions before 8.1.0). D’CENT has said hardware wallets themselves are not confirmed compromised, but anyone who imported a seed into the App Wallet is exposed. D’CENT supports both XRPL and Stellar, so both assets can leave the same compromised key.
https://t.co/6GvIpgLtIH
D’CENT first flagged abnormal transfers on 16 Sep, told users to update the app and move funds to new recovery phrases, and said they are working with Korean law enforcement and asking exchanges to freeze funds. Some drains have continued after the main waves as remaining keys are used.
What I am asking
@chainalysis@trmlabs@DOJFraudDiv@XRPLF@StellarOrg@DCENTWALLETS
Please review these two transactions, identify the destination / collector addresses, and help flag or freeze any funds that have not yet been swapped off-chain (prior D’CENT waves used THORChain, https://t.co/sMMR0FW0JM, NEAR Intents, Binance tags, etc.).
I did not share my seed phrase with anyone. I am posting the explorer links so the movement can be verified independently.
Warning to anyone reading this
Do not DM me offering “recovery,” “whitelist,” or “private investigator” services. Those are scams that target people who just posted a loss. I will only work through official channels or well-known on-chain analysts.
If you have been hit in the same D’CENT App Wallet wave, document your tx hashes the same way and report to D’CENT + local law enforcement. Generate a brand new recovery phrase on a device that never touched the old App Wallet before moving anything remaining.
Thank you to anyone who can help trace this.
@allthemoney
@NFAdotcrypto@NFAdotcrypto I was just hacked today for over $100k+ of XRP and XLM... You can check my page... Can you please direct me to some of these guys/gals that might be able to help me out? Much help is appreciated! Thanks
@digitalassetbuy Please check your DMs... I was just hacked on my Ledger for $100k+ and im trying to contact anyone who might be able to help... Thanks @digitalassetbuy