{"id":13630,"date":"2026-09-23T18:53:57","date_gmt":"2026-09-23T18:53:57","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13630"},"modified":"2026-09-23T18:53:57","modified_gmt":"2026-09-23T18:53:57","slug":"nearly-20-million-in-xrp-drained-from-6678-wallets-across-six-attack-waves","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13630","title":{"rendered":"Nearly $20 million in XRP drained from 6,678 wallets across six attack waves"},"content":{"rendered":"

<\/p>\n

\n

Nearly $20 million of XRP was drained from thousands of hardware wallets in six waves spanning nearly a week.<\/p>\n

Blockchain analysis firm XRPL.to traced 11.75 million XRP leaving 6,678 distinct wallets between Sept. 15 and Sept. 20, including several collection waves after DCENT warned users of unauthorized transfers involving its mobile App Wallet.<\/p>\n

At XRP\u2019s current price of about $1.59, the tokens are worth roughly $18.68 million.<\/p>\n

XRPL.to dates the first identified sweep to 15:35 UTC on Sept. 15. DCENT said it received its first customer report in Korea on Sept. 16 and began notifying users through its app and official channels that day.<\/p>\n

\"XRP\"XRP
XRP Drained from D’CENT Wallets (Source:XRPL.to)<\/figcaption><\/figure>\n

The draining then resumed.<\/p>\n

Another collection wave began at 07:05 UTC on Sept. 17, according to XRPL.to, while the final sweep captured in its investigation occurred at 20:56 UTC on Sept. 20.<\/p>\n

The investigator counted 4,208 wallets swept through payment transactions and another 2,470 emptied through account deletion without a preceding payment in the dataset it traced. It also identified 5,001 AccountDelete transactions originating from 4,950 wallets, including accounts that had already been partially emptied.<\/p>\n

Account deletion allowed whoever controlled the keys to extract balances that ordinary payment sweeps could leave behind. XRP Ledger (XRPL) accounts maintain a reserve while they remain open, but an AccountDelete transaction can close an eligible account and forward its remaining XRP, minus the deletion fee, to another address.<\/p>\n

One such deletion moved 107,507 XRP, worth about $171,000 at current prices.<\/p>\n

XRPL.to said the payment and deletion transactions were validly signed with the affected accounts\u2019 keys. The blockchain trail does not reveal how those keys were obtained, and DCENT has yet to disclose the technical cause of the incident.<\/p>\n

More than 5.6 million XRP moved through THORChain<\/h2>\n

Much of the stolen XRP had already begun leaving the XRP Ledger by the time investigators mapped the flows.<\/p>\n

\n

Related Reading<\/span><\/p>\n

This XRP project is shutting down after wallet flaw exposed 4,000 accounts and drained $450,000<\/h3>\n<\/p>\n

<\/span> <\/div>\n

XRPL.to traced 5.67 million XRP through THORChain as of 11:26 UTC on Sept. 21, including about 5.59 million XRP sent from two collection waves through transactions whose memos specified Ethereum destination addresses.<\/p>\n