Nearly $20 million in XRP stolen from 6,678 wallets in six attack waves
Attack summary
Between September 15 and September 20, 2026, attackers drained roughly 11.75 million XRP – worth about $18.7 million at the time – from 6,678 distinct wallets. The theft occurred in six separate waves, starting at 15:35 UTC on September 15 and ending with a final sweep at 20:56 UTC on September 20.
Key figures
- ≈ $19 million (11.75 million XRP) stolen.
- 6,678 wallets affected.
- 4,208 wallets emptied via payment transactions.
- 2,470 wallets emptied through AccountDelete transactions (which close an account and forward remaining XRP).
- One AccountDelete moved 107,507 XRP (~$171,000).
- First report received by wallet maker DCENT on September 16.
How the funds moved
Blockchain analysis traced more than 5.6 million XRP through THORChain, a cross‑chain liquidity protocol that lets assets move between blockchains. About 5.59 million XRP was sent to Ethereum addresses, and another 3.24 million XRP went to the exchange unionchain.ai. Smaller amounts reached NEAR Intents (≈ 546,000 XRP) and Binance deposit tags (≈ 536,000 XRP). At the time of the latest snapshot, roughly 1.31 million XRP remained in wallets linked to the operation.
DCENT’s response
DCENT, the hardware‑wallet provider whose App Wallet was used, is working with Korean law enforcement, external security experts, blockchain projects and exchanges to trace the stolen assets and request freezes where possible. The company has not announced a completed freeze or recovery.
DCENT urged users to update the app from the official store, move their holdings to a new wallet created with a fresh recovery phrase, and avoid any messages that request a recovery phrase, private key or PIN. Users who ever entered their recovery phrase into the App Wallet – even if they later used a hardware device – were asked to follow the same migration steps.
Unresolved issues
- The blockchain trail shows that the transactions were signed with the legitimate private keys, but how those keys were exposed has not been disclosed.
- No public information confirms whether any of the stolen XRP has been recovered or frozen.
Why it matters
The incident highlights the risk of key exposure in mobile wallet applications and the difficulty of tracing assets once they cross chains via services like THORChain. It also underscores the importance of keeping recovery phrases separate from any software that may be compromised.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.