Attackers drained roughly 11.7 million XRP, worth close to $20 million, from 6,678 DCENT App Wallet users in six waves between Sept. 15 and Sept. 20, 2026. XRPL.to's on-chain analysis found that the transactions used valid signatures from compromised private keys rather than exploiting the XRP Ledger. The operation began with manual drains from eight wallets holding more than 99,999 XRP each, followed by an automated sweep of 1,682 wallets on Sept. 15. Attackers also used 5,001 AccountDelete transactions to collect reserve balances, including from 2,470 wallets that had not first been swept. Roughly 5.6 million XRP moved to Ethereum through THORChain, while other funds reached unionchain.ai, NEAR Intents and Binance-linked deposit tags. DCENT confirmed abnormal App Wallet transfers on Sept. 16, said hardware wallets were unaffected, and urged users to create new wallets with fresh recovery phrases and move their assets. XRP traded near $1.49 in the latest report, down 6% over 24 hours, compared with about $1.50 and a 5.5% decline reported on Sept. 23.