Nearly $20 million in XRP drained from 6,678 wallets across six attack waves | featured Ripple

Nearly $20 million in XRP was drained from 6,678 hardware wallets in six waves over nearly a week, according to blockchain analysis by XRPL.to. The firm traced 11.75 million XRP leaving distinct wallets between Sept. 15 and Sept. 20. The activity included collection waves after DCENT warned users about unauthorized transfers tied to its mobile App Wallet. XRPL.to dates the first sweep to 15:35 UTC on Sept. 15, with DCENT receiving its first customer report in Korea on Sept. 16 and notifying users that day. Additional sweeps occurred at 07:05 UTC on Sept. 17 and the final captured at 20:56 UTC on Sept. 20. XRPL.to found 4,208 wallets emptied via payment transactions and 2,470 via account deletion. It reports that about 5.67 million XRP moved through THORChain, with further flows to unionchain.ai, NEAR Intents, and Binance-linked deposits, complicating recovery. DCENT says it’s working with Korean law enforcement, while the technical cause remains undisclosed.