$20 Million in XRP Stolen From Thousands of Hardware Wallets

Attackers drained roughly 11.7 million XRP from thousands of D’CENT App Wallet users. The theft, worth close to $20 million, unfolded between September 15 and 20. XRPL.to published the on-chain forensic timeline. The operation unfolded across six separate waves.

It hit a combined 6,678 wallets using keys the thief already controlled. How the Attack Actually Unfolded Someone manually drained eight wallets, each holding over 99,999 XRP, within an hour on September 15. An automated script then swept a total of 1,682 wallets that same day.

Five more waves followed through September 20. Each wave reused the same script, manual tool, and stolen keys. Attackers went beyond simple transfers, too. They deleted 5,001 accounts entirely to claim their remaining reserve balances, XRPL.to reported.

Notably, 2,470 of those wallets had never been swept. That detail suggests the thief held a broader list of compromised keys than the initial drain revealed. Follow us on X to get the latest news as it happens. Wallets swept per hour (up) and accounts deleted per hour (down).