Nearly $20 million in XRP drained from 6,678 wallets in six waves

Nearly $20 million in XRP was drained from 6,678 hardware wallets across six waves. XRPL.to traced 11.75 million XRP leaving the wallets between Sept. 15 and Sept. 20. At XRP's current price of about $1.59, the tokens were worth roughly $18.68 million. The first identified sweep occurred at 15:35 UTC on Sept. 15. DCENT received its first customer report in Korea on Sept. 16. DCENT began notifying users through its app and official channels that day. Another collection wave began at 07:05 UTC on Sept. 17. The final sweep in the investigation occurred at 20:56 UTC on Sept. 20. Payment transactions swept 4,208 wallets. Account deletion emptied another 2,470 wallets without a preceding payment in the traced dataset. XRPL.to identified 5,001 AccountDelete transactions from 4,950 wallets. AccountDelete transactions could extract XRP that ordinary payment sweeps might leave in an account reserve. One AccountDelete transaction moved 107,507 XRP worth about $171,000 at current prices. XRPL.to said the payment and deletion transactions were validly signed with the affected accounts' keys. The blockchain trail does not reveal how the keys were obtained. DCENT has not disclosed the technical cause. XRPL.to traced 5.67 million XRP through THORChain as of 11:26 UTC on Sept. 21. About 5.59 million XRP came from two collection waves through transactions with memos specifying Ethereum destination addresses. Another 3.24 million XRP flowed to unionchain.ai. XRPL.to described unionchain.ai as an exchange. About 546,080 XRP reached NEAR Intents. Another 535,666 XRP moved into Binance deposit tags. Around 1.31 million XRP remained in wallets linked to the operation at the investigator's snapshot. DCENT is working with Korean law enforcement, outside security specialists, blockchain projects and exchanges to trace the money. DCENT is requesting freezes where possible. DCENT has not announced a completed freeze or recovery. Any such action depends on law enforcement, exchanges and other third parties controlling the services through which the funds traveled. DCENT urged App Wallet users to move assets out of the app on Sept. 20. DCENT told affected users to update the app from an official app store. DCENT then told them to move their holdings to a wallet created with an entirely new recovery phrase. DCENT said hardware-wallet users who entered or restored a recovery phrase inside its App Wallet should follow the same migration procedure. Reusing the same phrase on a hardware device does not generate new private keys. DCENT's potential-impact criteria include addresses whose recovery phrase was used in the App Wallet. The criteria also include addresses that signed transactions with an app version earlier than 8.1.0. Version 8.1.0 was released Nov. 5, 2025. DCENT said hardware users who never entered their recovery phrase into the App Wallet and never used the software wallet to sign transactions do not need to migrate under its current criteria. DCENT warned users about impersonators seeking to exploit the incident. The company said it will never ask for a recovery phrase, private key or PIN. DCENT also said it will not provide a wallet address for users to send assets for recovery or compensation. DCENT said on Sept. 20 that it was still developing a process to determine the impact scope and the status of affected assets.