Nearly $20 million in XRP Drained from 6,678 Wallets Across Six Attack Waves

Blockchain analysis firm XRPL.to identified a series of six coordinated sweeps that moved roughly 11.75 million XRP—about $18.7 million at current prices—from 6,678 distinct wallets between September 15 and September 20.

Timeline of the Sweeps

The first sweep was recorded at 15:35 UTC on September 15. DCENT received its first user report on September 16 and began issuing warnings. Subsequent waves followed on September 17 (07:05 UTC) and continued through the final identified sweep at 20:56 UTC on September 20.

Methods Used

• 4,208 wallets were emptied via standard payment transactions.
• 2,470 wallets were cleared through AccountDelete transactions, which close the account and forward remaining XRP (minus a deletion fee) to another address.
• 5,001 AccountDelete transactions originated from 4,950 wallets, including partially emptied accounts.

One deletion moved 107,507 XRP (≈ $171,000). All transactions were validly signed with the compromised keys, but the source of the key compromise has not been disclosed.

Post‑Sweep Flow of Funds

Investigators tracked more than 5.6 million XRP moving off the XRP Ledger, primarily through THORChain. Key destinations included:

• ≈ 5.59 million XRP sent to Ethereum addresses via THORChain.
• ≈ 3.24 million XRP to an exchange identified as unionchain.ai.
• ≈ 546,080 XRP to NEAR Intents.
• ≈ 535,666 XRP to Binance deposit tags.
• ≈ 1.31 million XRP remained in wallets linked to the operation at the time of the snapshot.

DCENT’s Response

DCENT has been cooperating with Korean law enforcement, security specialists, blockchain projects, and exchanges to trace and potentially freeze the stolen assets. The company urges all users of its App Wallet to:

1. Update the app from an official store.
2. Move assets to a new wallet created with a fresh recovery phrase.
3. Avoid re‑using any recovery phrase that was ever entered into the App Wallet, even on hardware devices.

DCENT also warned of possible impersonation attacks and clarified that it will never request recovery phrases, private keys, PINs, or direct users to send assets to a specific address for recovery.

Outlook

Recovery of the stolen XRP depends on actions by law enforcement, exchanges, and other third parties controlling the flow of funds. DCENT has not announced any successful freezes or recoveries to date.