$20 Million in XRP Stolen From Thousands of Hardware Wallets

Source Beincrypto

Attackers drained roughly 11.7 million XRP from thousands of D’CENT App Wallet users. The theft, worth close to $20 million, unfolded between September 15 and 20. XRPL.to published the on-chain forensic timeline.

The operation unfolded across six separate waves. It hit a combined 6,678 wallets using keys the thief already controlled.

How the Attack Actually Unfolded

Someone manually drained eight wallets, each holding over 99,999 XRP, within an hour on September 15. An automated script then swept a total of 1,682 wallets that same day.

Five more waves followed through September 20. Each wave reused the same script, manual tool, and stolen keys.

Attackers went beyond simple transfers, too. They deleted 5,001 accounts entirely to claim their remaining reserve balances, XRPL.to reported.

Notably, 2,470 of those wallets had never been swept. That detail suggests the thief held a broader list of compromised keys than the initial drain revealed.

Follow us on X to get the latest news as it happens.

Wallets swept per hour (up) and accounts deleted per hour (down). Source: xrpl.toWallets swept per hour (up) and accounts deleted per hour (down). Source: xrpl.to

The stolen funds moved fast. Roughly 5.6 million XRP crossed into Ethereum through THORChain. Other funds are routed through exchanges, including Binance, as well as services like unionchain.ai and NEAR Intents.

Each sweep often reached an off-ramp within hours, limiting the window available for freezing stolen funds. About 1.3 million XRP still sat in the attacker’s own wallets as of September 21.

Why Are D’CENT Users Specifically at Risk?

D’CENT confirmed abnormal transfers affecting its App Wallet on September 16. The company clarified that hardware wallets remained unaffected. It later urged users to move funds immediately, though it has not confirmed whether reimbursement will follow.

Notably, no XRP Ledger exploit caused this incident. Every sweep used valid signatures from the wallets’ own private keys. That detail means the compromise originated from how those keys were exposed, not from any flaw in the network itself.

5.6 Million XRP Moved to Ethereum Through THORChain. Source: xrpl.to5.6 Million XRP Moved to Ethereum Through THORChain. Source: xrpl.to

XRPL.to’s analysis found the operation reused identical scripts and fee patterns across multiple waves. That pattern strongly suggests a single coordinated actor carried out every stage. Security researchers now recommend one specific step.

Anyone who used D’CENT’s App Wallet at any point should migrate funds to a new wallet immediately. The exact method behind the original key compromise still remains unconfirmed.

XRP trades near $1.49 at the time of writing. That figure marked a 6% drop over the past 24 hours, according to BeInCrypto data. The token’s market cap stood near $93.82 billion, ranking fifth among all cryptocurrencies.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights.

Disclaimer: For information purposes only. Past performance is not indicative of future results.
placeholder
Dollar holds above 100 near a 3-month high — three Fed speakers and a $69 billion auction land tonightThe dollar index closed at 100.43 on Monday, its highest close since late July, after a weekly gain of about 1% — the best in more than three months — and is holding above the 100.00 handle in Asia. Three Fed officials speak tonight alongside a $69 billion two-year note auction, the first leg of $183 billion of Treasury supply this week.
Author  Suzie
Sep 22, Tue
The dollar index closed at 100.43 on Monday, its highest close since late July, after a weekly gain of about 1% — the best in more than three months — and is holding above the 100.00 handle in Asia. Three Fed officials speak tonight alongside a $69 billion two-year note auction, the first leg of $183 billion of Treasury supply this week.
placeholder
October hike odds climb toward 60% as Goldman and BofA both flip — what Warsh's "dose of accommodation" really changedRate futures now price roughly 55% to 62% for a 25bp hike at the October 27-28 FOMC, up from about 30% before Chair Warsh's post-meeting framing that the Fed is merely "removing some accommodation." Goldman Sachs has added an October hike to its forecast and Bank of America now sees moves in both October and December. Here is the repricing, the language behind it, and the two data points that decide it.
Author  Irene Q.
Sep 23, Wed
Rate futures now price roughly 55% to 62% for a 25bp hike at the October 27-28 FOMC, up from about 30% before Chair Warsh's post-meeting framing that the Fed is merely "removing some accommodation." Goldman Sachs has added an October hike to its forecast and Bank of America now sees moves in both October and December. Here is the repricing, the language behind it, and the two data points that decide it.
placeholder
Memory chips surge, Nasdaq notches a second straight record close — why the Dow fell 185 points anywayMicron gained 5%, SanDisk 6.8%, Seagate 4% and Western Digital 3% as the memory complex led the Nasdaq Composite to a second consecutive record close of 27,244.28. But the Dow fell 185 points as JPMorgan, Wells Fargo and Schwab slid more than 3% each — a split tape that says more about positioning than about the economy.
Author  Irene Q.
Sep 23, Wed
Micron gained 5%, SanDisk 6.8%, Seagate 4% and Western Digital 3% as the memory complex led the Nasdaq Composite to a second consecutive record close of 27,244.28. But the Dow fell 185 points as JPMorgan, Wells Fargo and Schwab slid more than 3% each — a split tape that says more about positioning than about the economy.
placeholder
US input costs rose at the fastest pace in four years — the September flash PMI beat is an inflation story, not a growth storyUS September flash PMIs came in far above expectations, with the composite at 58.4, a five-year high. But the detail that moved markets was input cost inflation at its fastest since October 2022, driven by fuel, transport and supply shortages. Brent is back above $100 and the 10-year Treasury yield has hit its highest since 2007.
Author  Suzie
Sep 24, Thu
US September flash PMIs came in far above expectations, with the composite at 58.4, a five-year high. But the detail that moved markets was input cost inflation at its fastest since October 2022, driven by fuel, transport and supply shortages. Brent is back above $100 and the 10-year Treasury yield has hit its highest since 2007.
placeholder
WTI (USOIL) Is down 2.03% on Sep 25: Here Is WhyWTI (USOIL) is down 2.03% at Sep 24 22:20(UTC+0), now at $92.517, with a 7-day down of 3.63%.What is driving WTI (USOIL)’s stock price down today?The drop in WTI crude oil prices was primarily driven by
Author  TradingKey
Sep 25, Fri
WTI (USOIL) is down 2.03% at Sep 24 22:20(UTC+0), now at $92.517, with a 7-day down of 3.63%.What is driving WTI (USOIL)’s stock price down today?The drop in WTI crude oil prices was primarily driven by
goTop
quote