$20 Million in XRP Stolen From Thousands of Hardware Wallets

Source Beincrypto

Attackers drained roughly 11.7 million XRP from thousands of D’CENT App Wallet users. The theft, worth close to $20 million, unfolded between September 15 and 20. XRPL.to published the on-chain forensic timeline.

The operation unfolded across six separate waves. It hit a combined 6,678 wallets using keys the thief already controlled.

How the Attack Actually Unfolded

Someone manually drained eight wallets, each holding over 99,999 XRP, within an hour on September 15. An automated script then swept a total of 1,682 wallets that same day.

Five more waves followed through September 20. Each wave reused the same script, manual tool, and stolen keys.

Attackers went beyond simple transfers, too. They deleted 5,001 accounts entirely to claim their remaining reserve balances, XRPL.to reported.

Notably, 2,470 of those wallets had never been swept. That detail suggests the thief held a broader list of compromised keys than the initial drain revealed.

Follow us on X to get the latest news as it happens.

Wallets swept per hour (up) and accounts deleted per hour (down). Source: xrpl.toWallets swept per hour (up) and accounts deleted per hour (down). Source: xrpl.to

The stolen funds moved fast. Roughly 5.6 million XRP crossed into Ethereum through THORChain. Other funds are routed through exchanges, including Binance, as well as services like unionchain.ai and NEAR Intents.

Each sweep often reached an off-ramp within hours, limiting the window available for freezing stolen funds. About 1.3 million XRP still sat in the attacker’s own wallets as of September 21.

Why Are D’CENT Users Specifically at Risk?

D’CENT confirmed abnormal transfers affecting its App Wallet on September 16. The company clarified that hardware wallets remained unaffected. It later urged users to move funds immediately, though it has not confirmed whether reimbursement will follow.

Notably, no XRP Ledger exploit caused this incident. Every sweep used valid signatures from the wallets’ own private keys. That detail means the compromise originated from how those keys were exposed, not from any flaw in the network itself.

5.6 Million XRP Moved to Ethereum Through THORChain. Source: xrpl.to5.6 Million XRP Moved to Ethereum Through THORChain. Source: xrpl.to

XRPL.to’s analysis found the operation reused identical scripts and fee patterns across multiple waves. That pattern strongly suggests a single coordinated actor carried out every stage. Security researchers now recommend one specific step.

Anyone who used D’CENT’s App Wallet at any point should migrate funds to a new wallet immediately. The exact method behind the original key compromise still remains unconfirmed.

XRP trades near $1.49 at the time of writing. That figure marked a 6% drop over the past 24 hours, according to BeInCrypto data. The token’s market cap stood near $93.82 billion, ranking fifth among all cryptocurrencies.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights.

Disclaimer: For information purposes only. Past performance is not indicative of future results.
placeholder
Dollar index tops 100 for the first time since July as the Fed's hawkish dot plot sinks inThe U.S. dollar index broke back above 100 for the first time since 31 July after the Fed delivered its first rate hike since 2023, with the dot plot showing 16 of 18 officials expect at least one more increase this year. Here are the levels that matter for DXY, the currencies feeling it most, and what to watch next.
Author  Irene Q.
Sep 17, Thu
The U.S. dollar index broke back above 100 for the first time since 31 July after the Fed delivered its first rate hike since 2023, with the dot plot showing 16 of 18 officials expect at least one more increase this year. Here are the levels that matter for DXY, the currencies feeling it most, and what to watch next.
placeholder
Gold ends three-week slide at the $4,400 line — eight straight days of ETF inflows vs a 5% 10-year and a 100 dollarSpot gold closed Friday at $4,378.39, up 0.84% on the day and about 0.8% for the week — its first weekly gain in four weeks — with the intraday high of $4,399.67 leaving it 33 cents shy of the $4,400 line. Gold ETFs have now logged eight straight sessions of inflows, but with the 10-year back above 5% and the dollar index near 100, here is what decides whether this is a reversal or a bounce.
Author  Suzie
Sep 20, Sun
Spot gold closed Friday at $4,378.39, up 0.84% on the day and about 0.8% for the week — its first weekly gain in four weeks — with the intraday high of $4,399.67 leaving it 33 cents shy of the $4,400 line. Gold ETFs have now logged eight straight sessions of inflows, but with the 10-year back above 5% and the dollar index near 100, here is what decides whether this is a reversal or a bounce.
placeholder
October hike odds climb toward 60% as Goldman and BofA both flip — what Warsh's "dose of accommodation" really changedRate futures now price roughly 55% to 62% for a 25bp hike at the October 27-28 FOMC, up from about 30% before Chair Warsh's post-meeting framing that the Fed is merely "removing some accommodation." Goldman Sachs has added an October hike to its forecast and Bank of America now sees moves in both October and December. Here is the repricing, the language behind it, and the two data points that decide it.
Author  Irene Q.
18 hours ago
Rate futures now price roughly 55% to 62% for a 25bp hike at the October 27-28 FOMC, up from about 30% before Chair Warsh's post-meeting framing that the Fed is merely "removing some accommodation." Goldman Sachs has added an October hike to its forecast and Bank of America now sees moves in both October and December. Here is the repricing, the language behind it, and the two data points that decide it.
placeholder
Memory chips surge, Nasdaq notches a second straight record close — why the Dow fell 185 points anywayMicron gained 5%, SanDisk 6.8%, Seagate 4% and Western Digital 3% as the memory complex led the Nasdaq Composite to a second consecutive record close of 27,244.28. But the Dow fell 185 points as JPMorgan, Wells Fargo and Schwab slid more than 3% each — a split tape that says more about positioning than about the economy.
Author  Irene Q.
17 hours ago
Micron gained 5%, SanDisk 6.8%, Seagate 4% and Western Digital 3% as the memory complex led the Nasdaq Composite to a second consecutive record close of 27,244.28. But the Dow fell 185 points as JPMorgan, Wells Fargo and Schwab slid more than 3% each — a split tape that says more about positioning than about the economy.
placeholder
Gold Price Forecast: XAU/USD drifts toward $4.300 with bears gaining tractionGold (XAU/USD) retraces Tuesday’s gains on Wednesday and drifts lower, approaching the $4,300 area as the US Dollar Index (DXY) rallies further amid high US Treasury yields.
Author  FXStreet
14 hours ago
Gold (XAU/USD) retraces Tuesday’s gains on Wednesday and drifts lower, approaching the $4,300 area as the US Dollar Index (DXY) rallies further amid high US Treasury yields.
goTop
quote