Nearly $20 million in XRP drained from 6,678 wallets across six attack waves

Nearly $20 million of XRP was drained from thousands of hardware wallets in six waves spanning nearly a week.

Blockchain analysis firm XRPL.to traced 11.75 million XRP leaving 6,678 distinct wallets between Sept. 15 and Sept. 20, including several collection waves after DCENT warned users of unauthorized transfers involving its mobile App Wallet.

At XRP’s current price of about $1.59, the tokens are worth roughly $18.68 million.

XRPL.to dates the first identified sweep to 15:35 UTC on Sept. 15. DCENT said it received its first customer report in Korea on Sept. 16 and began notifying users through its app and official channels that day.

The draining then resumed.

Another collection wave began at 07:05 UTC on Sept. 17, according to XRPL.to, while the final sweep captured in its investigation occurred at 20:56 UTC on Sept. 20.

The investigator counted 4,208 wallets swept through payment transactions and another 2,470 emptied through account deletion without a preceding payment in the dataset it traced. It also identified 5,001 AccountDelete transactions originating from 4,950 wallets, including accounts that had already been partially emptied.

Account deletion allowed whoever controlled the keys to extract balances that ordinary payment sweeps could leave behind. XRP Ledger (XRPL) accounts maintain a reserve while they remain open, but an AccountDelete transaction can close an eligible account and forward its remaining XRP, minus the deletion fee, to another address.

One such deletion moved 107,507 XRP, worth about $171,000 at current prices.

XRPL.to said the payment and deletion transactions were validly signed with the affected accounts’ keys. The blockchain trail does not reveal how those keys were obtained, and DCENT has yet to disclose the technical cause of the incident.

More than 5.6 million XRP moved through THORChain

Much of the stolen XRP had already begun leaving the XRP Ledger by the time investigators mapped the flows.

XRPL.to traced 5.67 million XRP through THORChain as of 11:26 UTC on Sept. 21, including about 5.59 million XRP sent from two collection waves through transactions whose memos specified Ethereum destination addresses.

Another 3.24 million XRP flowed to unionchain.ai, which XRPL.to described as an exchange, while about 546,080 XRP reached NEAR Intents and 535,666 XRP moved into Binance deposit tags.

Around 1.31 million XRP remained in wallets linked to the operation at the investigator’s snapshot.

The destinations complicate attempts to recover the assets. THORChain and NEAR Intents can move value between networks, creating additional trails investigators must follow once XRP has been exchanged for assets on another blockchain.

Meanwhile, transfers to exchange-linked addresses could offer potential intervention points, though a deposit address alone does not establish whether the funds were sold or remain accessible.

DCENT said it has been working with Korean law enforcement, outside security specialists, blockchain projects and exchanges to trace the money and request freezes where possible.

The company has not announced a completed freeze or recovery. It has said any such action depends on law enforcement, exchanges and other third parties controlling the services through which funds traveled.

DCENT urges holders to abandon exposed recovery phrases

The continuing sweeps prompted DCENT to escalate its warning on Sept. 20, asking the broader blockchain and crypto community to help reach App Wallet users who might not have seen its earlier notices.

“The most important step to prevent further damage is moving assets out of the DCENT App Wallet,” the company said, urging users and crypto communities to spread its guidance directly to anyone known to use the app.

DCENT told affected users to update the app from an official app store before taking further action and move their holdings to a wallet created with an entirely new recovery phrase.

That requirement also extends to some hardware-wallet users.

DCENT said anyone who previously entered or restored a hardware wallet’s recovery phrase inside its App Wallet should follow the same migration procedure. Moving the same phrase back onto a hardware device does not generate new private keys, meaning any prior exposure follows the phrase into the new device.

The company’s potential-impact criteria also include addresses whose recovery phrase was used in the App Wallet and that signed transactions using an app version earlier than 8.1.0, released Nov. 5, 2025. Users who later upgraded the software are still being asked to consider which version was installed when they previously signed transactions.

DCENT says hardware users who never entered their recovery phrase into the App Wallet and never used the software wallet to sign transactions do not need to migrate under its current criteria.

The company has also warned users against a second wave of potential losses from impersonators exploiting the incident. DCENT said it will never ask for a recovery phrase, private key, or PIN and will not provide a wallet address to which users must send assets for recovery or compensation.

For users who have already suffered unauthorized transfers, DCENT said on Sept. 20 that it was still developing a process for determining the scope of impact and the status of affected assets.