Nearly $19M in XRP drained from 6,678 wallets

Blockchain analysis firm XRPL.to traced roughly 11.75 million XRP, about $18.7 million at current prices, moving out of 6,678 distinct wallets in six collection waves between Sept. 15 and Sept. 20. The firm identified the first sweep at 15:35 UTC on Sept. 15 and logged additional waves, including a large collection beginning at 07:05 UTC on Sept. 17 and a final sweep at 20:56 UTC on Sept. 20.

XRPL.to counted 4,208 wallets emptied by payment transactions and 2,470 accounts closed with AccountDelete operations. In total the investigator recorded 5,001 AccountDelete transactions originating from 4,950 wallets. One AccountDelete forwarded 107,507 XRP, about $171,000 at current prices.

The traced payments and account deletions were validly signed with the affected accounts’ keys, according to XRPL.to. The blockchain record does not show how the keys were obtained.

DCENT, the developer of the App Wallet tied to the affected addresses, received its first customer report in Korea on Sept. 16 and began notifying users that day. The company has been working with Korean law enforcement, outside security specialists, blockchain projects and exchanges to trace funds and request freezes where possible. No completed freezes or recoveries have been announced.

Large amounts of the transferred XRP left the XRP Ledger quickly. XRPL.to traced about 5.67 million XRP routed through THORChain as of 11:26 UTC on Sept. 21, including transactions with memos pointing to Ethereum destinations. Another 3.24 million XRP went to an entity identified as unionchain.ai, about 546,080 XRP reached NEAR Intents, and roughly 535,666 XRP were sent to Binance deposit tags. At the investigator’s snapshot about 1.31 million XRP remained in wallets linked to the operation.

THORChain and NEAR Intents can move value across different blockchains, which means investigators must follow additional transaction paths once value is exchanged on other networks. Transfers to exchange-linked deposit addresses present potential intervention points, but a deposit address alone does not reveal whether funds have been withdrawn or sold.

DCENT advised affected users to abandon any recovery phrases entered into its App Wallet and to move assets to wallets created with entirely new recovery phrases. The company instructed users to update the app from official app stores before migrating assets and warned that restoring the same phrase to a hardware device does not produce new private keys. The developer asked anyone who entered or restored a hardware-wallet recovery phrase inside the App Wallet, or who used the app to sign transactions on versions earlier than 8.1.0 (released Nov. 5, 2025), to create new wallets with fresh phrases. Hardware users who never entered their recovery phrase into the App Wallet and never used the software wallet to sign transactions are not required to migrate under these criteria.

DCENT warned of fraud attempts following the incident and emphasized it will not request recovery phrases, private keys or PINs, and will not provide an address for victims to send assets for recovery or compensation. In an advisory the company wrote, “The most important step to prevent further damage is moving assets out of the DCENT App Wallet.”

Investigators and DCENT continue to trace asset flows and contact third parties for possible interventions, particularly where funds reached exchange-linked deposit addresses. XRPL.to’s findings leave open key questions about how the account keys were compromised, and DCENT is developing a process to determine the full scope of impacted accounts and the status of affected assets.