Nearly $20 million in XRP drained from 6,678 wallets across six attack waves
Nearly $20 million in XRP was drained from 6,678 wallets in six waves over a week, according to blockchain analysis firm XRPL.to. The thefts began on Sept. 15 and continued until Sept. 20, with funds moving through THORChain and other exchanges. DCENT, whose mobile App Wallet was involved, advised users to move assets to new wallets and warned of potential impersonation scams. The company is working with law enforcement to trace and freeze funds.
How this was made

The 30-second read
Why it matters
The theft underscores ongoing security risks in crypto wallets and may trigger price volatility for XRP.
Market read
First‑report of a $20M XRP theft could drive short‑term price pressure and heightened security scrutiny.
What to watch
Potential for recovery actions by exchanges or law enforcement could mitigate long‑term price effects.
Background
The article details a multi‑wave theft of XRP from hardware wallets, tracing flows through THORChain, NEAR, and Binance.
Ticker impact
Nearly $20M of XRP was drained from 6,678 wallets in six attack waves between Sept. 15-20, a first‑report theft affecting the crypto.
Potential short‑term downside as market reacts to theft news.
Large absolute amount ($18‑20M) and multiple attack vectors suggest heightened risk perception.
Market effects
Highlights security vulnerabilities in wallet providers and may affect other crypto custodial services.
Korea‑focused alerts could influence regional crypto trading activity.
Large theft could dampen broader XRP sentiment worldwide.
Counterpoint
Some may view the dip as a buying opportunity if they believe the theft impact will be short‑lived.
Key entities
- companyDCENT
Provider of the compromised App Wallet that issued warnings.
- protocolTHORChain
Cross‑chain bridge used to move stolen XRP.





