Crypto
Home›Crypto›Market Structure›Nearly $20 million in XRP drained across six hardware…
Nearly $20 million in XRP drained across six hardware wallet attack waves
XRPL.to said the loss was traced to 6,678 wallets between Sept. 15 and Sept. 20, including 5,001 AccountDelete transactions used to extract remaining balances.
Nearly $20 million in XRP was drained from thousands of hardware wallets in six attack waves over nearly a week, according to blockchain tracing firm XRPL.to. The wallet sweeps occurred between Sept. 15 and Sept. 20 and involved 6,678 distinct wallets, with 11.75 million XRP identified as leaving those accounts during the investigation window.
Using XRPL transaction analysis, XRPL.to found that 4,208 wallets were swept via payment transactions, while 2,470 wallets were emptied through account deletion without a preceding payment. It said the deletion activity included 5,001 AccountDelete transactions originating from 4,950 wallets, and that those AccountDelete actions could close eligible XRPL accounts and forward remaining XRP, minus the deletion fee, to another address.
The timestamps identified by XRPL.to include a first sweep at 15:35 UTC on Sept. 15, additional collection waves beginning at 07:05 UTC on Sept. 17, and a final sweep at 20:56 UTC on Sept. 20. Crypto security firm DCENT, which warned users about unauthorized transfers tied to its mobile App Wallet, began notifying customers in Korea on Sept. 16 after its first customer report.
XRPL.to said much of the stolen XRP had already moved off the XRP Ledger by the time it mapped the flows, tracing 5.67 million XRP through THORChain as of 11:26 UTC on Sept. 21. It also reported that about 3.24 million XRP flowed to unionchain.ai, around 546,080 XRP reached NEAR Intents, and 535,666 XRP moved into Binance deposit tags, with about 1.31 million XRP still linked to operation-associated wallets at its snapshot. The blockchain trail did not show how the attackers obtained the keys, and DCENT had not yet disclosed the technical cause of the incident.
CryptoSlate reported that XRPL accounts maintain a reserve while they are open, but that AccountDelete transactions can close accounts and move remaining balances, even when payment sweeps alone might leave some XRP behind. It added that THORChain and NEAR Intents can move value between networks, creating additional trails for investigators to follow once XRP has exited the XRP Ledger.
Latest closeXRP $1.494 ▼5.0%