Money XRP worth almost 20 million dollars was withdrawn from the wallet 6,678 bills through attack 6 blocks

XRP worth nearly 20 million US dollars was pulled from thousands of hardware wallets via a six-time ransomware attack that took almost a week.

Blockchain analytics company XRPL.to revealed that there were 11.75 million units of XRP withdrawn from 6,678 different wallets between September 15 and 20, including several fundraisers after DCENT issued a warning to users about unauthorized transfers involving the company's App Wallet.

Based on the current price of XRP which is around 1.59 dollars, the value of coins that were withdrawn was about 18.68 million dollars.

XRPL.to notes that the first detected hacking occurred at 15:35 UTC on September 15. DCENT reports it received its first report from a customer in South Korea on September 16 and began notifying users through its app and official channels on the same day.

From there, the withdrawals continued.

XRPL.to notes that the roundup log started at 07:05 UTC on September 17, while the last roundup recorded in the investigation occurred at 20:56 UTC on Sept. 20.

Investigators found that there were 4,208 wallets scraped through a payment transaction and another 2,470 accounts retrieved without prior payment in the traceable database. Additionally, they also found 5,001 deleted business account listings from 4,950 wallets, including some withdrawn accounts.

Account deletion allows those who control the keys to withdraw a maximum amount that may remain in their account. An account on XRP Ledger (XRPL) will need to have cash reserves remaining while the account is still active, but Business Accounts Delete can close an eligible account and transfer the remainder of the account to another location

One account has moved XRP numbered 107,507 units which have a value of approximately 171,000 dollars at current prices

XRPL.to notes that all payment and accounting transactions were properly signed with the keys of the affected accounts, however, traces on the blockchain do not reveal how those keys were stolen and DCENT has yet to identify a technical cause for this incident.

More than 5.6 million units flowed through THORChain .

When investigators created a map of the flow of money, most of the value of XRP that was stolen started to leave XRP Ledger gone.

XRPL.to tracked XRP 's total of 5.67 million units shipped through THORChain at 11:26 UTC on September 21st, including approximately 5.59 million units that were sent from the two collection lines via businesses specified in end-of-way addresses on Ethereum as part of the memo.

Another 3.24 million units were sent to unionchain.ai, which XRPL.to identified as a shopping center while XRP approximately 546,080 units reached NEAR Intents and another 535,666 units were transferred into the deposit tags of Binance .

At the time investigators recorded, there were still XRP approximately 1.31 million units in wallets connected to this operation.

These routes make asset recovery even more difficult because THORChain and NEAR Intents can transfer value across the network, creating additional paths that investigators must follow after XRP is exchanged for assets on another blockchain.

On the other hand, a transfer to an address connected to a shopping center may be a possible bargaining point even if that address alone cannot confirm whether funds have been sold or are still accessible.

DCENT stated that the company has collaborated with South Korean law enforcement agencies, security experts outside of Blockchain Project and shopping centers to track currency routes and request freezes where possible.

At this time, the company has not announced a successful seizure or recovery. It noted that such operations are dependent on law enforcement agencies, shopping centers and other third parties who control services through which funds flow.

DCENT requests that affected holders stop using the disclosed refund policy

The ongoing money laundering prompted DCENT to raise the alert on September 20 by asking for collaboration from the blockchain and crypto community at large, reaching out to users APP wallet who may not have seen previous announcements.

The company stated that "the most important step in preventing further damage is to transfer assets out of DCENT APP wallet " with a call for users and the crypto community to disseminate this advice directly to all known app users.

DCENT advises affected users to update the app from their official store before taking any further action and transfer assets to a wallet created with newly recovered funds ( recovery phrase ).

This regulation also covers some hardware wallet users.

DCENT states that anyone who has ever requested or redeemed a recovery of their hardware wallet within APP wallet should follow the same transfer procedure, as bringing the original recovery back to the device's hardware does not generate new private keys. This means there is a risk of leakage from previously tracked wallets to the new device as well.

Requirements for those who may be affected by the company include that they use a recovery password on APP wallet and sign up via an older app version of 8.1.0 which was released on 5 November 2025 Users who update software later are still asked to consider whether signing up is using any previous version

DCENT states that hardware users who have never requested a refund on APP and never used the wallet software in business names are not required to move their wallets according to current requirements.

In addition, the company also warned users about the risk of a second round from claimants who could take advantage of this event. DCENT asserted that the company would not ask for their private keys or PINs to be returned at all and wouldn't provide wallet addresses to users in order to send items there for redemption or reimbursement.

For users who have experienced unauthorized transfers, DCENT stated on September 20 that it is still developing a process to determine the extent of damage and status of affected property.

This is information from CryptoSlate