Attackers drained about 11.7 million XRP, worth close to $20 million, from 6,678 wallets created through the D'CENT app between September 15 and September 20. The theft came in six separate waves, starting with a manual drain of eight large wallets before an automated script took over.

On the first day alone, the script emptied 1,682 wallets. The attackers also deleted 5,001 accounts entirely to collect the reserve balances the XRP Ledger requires every account to hold, recovering funds that would otherwise have stayed locked.

The pattern points to exposed wallet keys rather than a flaw in the XRP Ledger itself. D'CENT is still investigating how the signing keys were compromised and has urged affected users to move their assets. More than 5.6 million XRP was routed through THORChain as the attackers moved funds across networks.

For users of the same wallet app, the priority is moving assets to newly generated keys, since any key created under the compromised process may be at risk. The investigation's findings on how the keys leaked will show whether other wallet software shares the same weakness.