Between September 15 and September 20, 6,678 accounts on the XRP Ledger were emptied. Not phished one keystroke at a time — swept, in six coordinated waves. 11.75 million XRP. Roughly $18.68 million at prevailing prices.
The ledger itself was never breached. Every transaction carried a valid signature produced by the victim's own key. The protocol executed exactly as written — including the clause that lets AccountDelete close an account and release both the base reserve and the owner reserve back to whoever holds the key. That detail matters more than the dollar figure. Whoever ran this sweep understood XRPL's reserve mechanics better than most people who write about XRP for a living.
DCENT operates a wallet product spanning an app and a hardware line inside the XRP ecosystem. Its post-incident guidance contains one sentence that explains the entire attack surface: users who had ever entered a hardware wallet recovery phrase into the App Wallet were told to migrate.
That is the whole insight. A recovery phrase is not a password. It is the deterministic seed from which every private key for an account is derived. The architectural promise of a hardware wallet — from the lab experiment to the global standard — is that this seed never crosses the secure element boundary. Input that seed into a software environment and the promise is void. Not weakened. Void. The keys now exist wherever the software put them: heap, persistent storage, logs, cloud backup, sync layer. Any single one is sufficient.
DCENT escalated to a full-community warning on September 20, published anti-impersonation notices, and routed affected users toward a migration path: update the app, generate a fresh recovery phrase, move assets. Korean users were the first to report the drain. Korean law enforcement, external researchers, exchanges, and chain-analysis providers were pulled in. What was not published was the root cause — and that omission is doing more damage than the theft.
Read the on-chain arithmetic carefully, because it separates two operations that observers keep collapsing into one word, "stolen."
4,208 wallets were drained through ordinary payment transactions. The attacker signed and pushed funds out. 2,470 were emptied through AccountDelete, which closes the account outright and recovers both the base reserve and the owner reserve. 4,208 plus 2,470 equals 6,678 — the two paths reconcile exactly with the reported victim count.
That second path is the tell. A reserve is XRP a user cannot spend while an account stays open; it sits locked by protocol rule. An attacker who bothers to close accounts and reclaim reserves is not grabbing loose change. They are harvesting the locked layer too. In 2022, while auditing three mid-cap DeFi lending pools, I found a reentrancy flaw in a withdrawal function and disclosed it privately rather than exploiting it. The relevant lesson from that work is narrower and more uncomfortable: attackers who read specifications line by line will always outpace teams that read them once, at launch.
Security Risk Score: 8/10 (Critical) — not because the loss was large, but because the exposure window was long and the boundary remains undefined.
Now follow the money out. Of the 11.75 million XRP:
- At least 5.67 million XRP (~48%) moved through THORChain into Ethereum-denominated assets. This is where the on-chain trail formally ends.
- 3.24 million XRP (~28%) landed at unionchain.ai, an exchange. That is a KYC chokepoint, and therefore a potential freeze point.
- 546,000 XRP (~5%) routed through NEAR Intents — intent-based cross-chain transfer, one more layer of obfuscation.
- 536,000 XRP (~5%) went to Binance deposit addresses, traceable through the exchange's compliance stack.
- 1.31 million XRP (~11%) still sits in related wallets, uncleaned.
Two technical observations deserve separate treatment. First, the two cleaning routes are not arbitrary. Wallets already emptied via payment transactions had no balance left to protect, so closing them recovered only reserves. The attacker optimized for total extraction, not for speed. Second, the composability chain tells you what cross-chain infrastructure actually does under stress: XRP Ledger, then THORChain, then Ethereum-denominated assets, then NEAR Intents. Each hop exists to serve legitimate users. Stacked in sequence by an adversary, they function as a laundering pipeline. Composability is neutral. Its neutrality is the risk.
The sequencing carries its own signal. First sweeps were detected September 15. DCENT received a report and notified users around September 16 — roughly a one-day lag. The drain continued in waves through September 20. Six days of sustained extraction means the exposure surface was not closed when it was first identified. Whether that reflects an unfixed product defect, an incomplete victim list, or a migration process still being finalized, the outcome is identical: DCENT's own migration criteria remain "in development," which means the boundary of exposure is unknown. Unknown boundaries are where tail risk lives.
There is also a documentation defect worth flagging. DCENT references app version 8.1.0 with a release date of November 5, 2025, while the sweep occurred in September of the same year. Either the version date was transcribed incorrectly, the years do not align, or the published timeline is internally inconsistent. Users should verify version numbers against official channels before acting on them. During a live security incident, an unreliable changelog is itself a risk vector.
The scale rules out the comfortable explanation. A single careless user loses one wallet. Six thousand six hundred and seventy-eight wallets, drained in six coordinated waves with reserve-aware cleanup and a six-way laundering split, is not user error. It is a systemic processing defect inside a product that handled seeds.
Here is where I part company with the dominant read.
XRP's supply is fixed at 100 billion, and no one's monetary policy changed this week. 11.75 million XRP is under 0.1% of XRP's market capitalization. Anyone marking XRP down on this headline is reading a chart that does not exist. The tokens are fungible and always were; a change of keyholder is not a change of fundamentals.
The real casualty is a belief: self-custody as unconditional safety. Liquidity moves fast, custody assumptions move slowly — and that asymmetry is the actual story. Hardware wallets retain capital not because they are convenient, but because the seed stays sealed inside the device. Break the seal, and the capital follows the seed out. Ledger, Trezor, and audited XRP-native wallets did not win this week through marketing. They won by not being in the blast radius.
Which leaves the competitive question. An incident of this shape redistributes users rather than destroying them. Products that hold keys in secure elements by design, and wallets that never ingested foreign seeds, were structurally immune. Migration demand is real, and it will flow toward vendors that can show audit reports instead of assurances.
The second counter-intuitive point concerns responsibility. If the root cause proves to be a software-side defect in how the App Wallet ingested, processed, or stored recovery material, the frame flips — from "users made a mistake" to "a vendor shipped a product that converted a hardware-grade secret into a software-grade liability." Those are different legal categories, different insurance questions, and different magnitudes of consequence. DCENT has already pushed recovery responsibility outward to law enforcement, exchanges, and third parties, which is itself an admission about its own freezing capability.
Watch the seed boundary, not the price. The next twelve months will be settled by three things: whether DCENT publishes a root cause, whether exchanges actually freeze the roughly one-third of funds that passed through KYC-controlled venues, and whether cross-chain protocols accept address-screening obligations after being used as laundering rails.
One question should outlive the headlines. If compliance overhead under MiCA already pushes small rollups toward consolidation, what does a validated security standard do to the wallet market? Regulation makes custody expensive. Incidents make it non-negotiable. Yields attract capital, but security retains it.
