Nearly 11.75 million XRP, worth about $18.7 million, was drained from 6,678 distinct wallets in six attack waves between Sept. 15 and Sept. 20, in a theft tied to the DCENT App Wallet, according to tracing by the XRP Ledger analytics service XRPL.to.
The transactions were validly signed with the victims’ own keys, XRPL.to said, which means the attacker had those keys. How the keys were obtained is unknown, and DCENT has not disclosed a technical cause. The tracing service counted 4,208 wallets emptied through payment transactions and another 2,470 wiped through account deletion; one deletion alone moved 107,507 XRP, about $171,000.
The first sweep hit at 15:35 UTC on Sept. 15. Further waves followed, including one beginning 07:05 UTC on Sept. 17, and the final traced sweep came at 20:56 UTC on Sept. 20.
DCENT said it received its first customer report in Korea on Sept. 16 and began notifying users through its app that day. On Sept. 20 the company escalated its warning in a post on X: “The most important step to prevent further damage is moving assets out of the DCENT App Wallet.” The company told hardware wallet users who entered or restored their recovery phrase inside the App Wallet to run the same migration, and it pointed to app versions before 8.1.0, released Nov. 5, 2025, as part of its criteria for addresses that may be affected.
Most of the stolen XRP has already left the ledger. XRPL.to traced 5.67 million XRP through THORChain as of Sept. 21, much of it headed to Ethereum addresses listed in transaction memos, along with 3.24 million XRP to an exchange it identifies as unionchain.ai, about 546,000 XRP to NEAR Intents and 535,666 XRP into Binance deposit tags. Around 1.31 million XRP still sat in wallets linked to the operation at the snapshot. DCENT said it is working with Korean law enforcement, outside security specialists and exchanges to trace funds and request freezes, but no completed freeze has been announced.
DCENT has also warned of impersonator scams and said it will never ask for a recovery phrase, private key or PIN.
