The alarming part of the DCENT incident is not the headline figure. It is that the draining continued, and intensified, after the vendor had already told customers something was wrong. Between Sept. 15 and Sept. 20, attackers ran six distinct collection waves against 6,678 DCENT wallets, and the waves kept coming through the vendor’s own public warnings.
That pattern says something specific about the compromise. A one-off phishing campaign burns out once users are alerted. A sustained, multi-wave sweep against thousands of independent accounts suggests the attacker already held the keys and was working through a list.
Key Takeaways
- 11.75 million XRP left 6,678 DCENT wallets between Sept. 15 and Sept. 20, worth roughly $18.68 million at the $1.59 XRP price cited in the analysis.
- The attackers used AccountDelete transactions, which the analysis describes as the means of bypassing XRP Ledger reserve requirements and maximising what could be extracted per account.
- Proceeds moved through THORChain, NEAR Intents and Binance, splitting the trail across chains and a centralised venue.
- DCENT received its first complaint from a user in Korea on Sept. 16 and began notifying users that day. Draining resumed anyway, with a fresh wave at 07:05 UTC on Sept. 17.
- As of Sept. 20, DCENT said it was still building a process to determine the scope of impact and the status of affected assets.
The transaction type is the story
AccountDelete is what separates this from an ordinary sweep. A plain payment moves a spendable balance and leaves behind whatever the ledger requires an account to hold in reserve. According to the analysis reported by woofun.ai, the attackers used AccountDelete transactions to get past that reserve requirement, which the report frames as a deliberate choice to maximise extraction efficiency.
Across 6,678 accounts, that choice is not cosmetic. Reserve balances that a simple drain would have stranded are, in aggregate, real money, and the technique also leaves the victim account closed rather than merely emptied. The report characterises the exploitation as targeting XRP Ledger account mechanics, not a flaw in the ledger’s consensus or its cryptography.
Two numbers circulate for the loss, and they are not in conflict. The report cites 11.75 million XRP leaving affected wallets over the five-day window, valued at approximately $18.68 million at an XRP price of about $1.59 at the time of the analysis. The “nearly $20 million” framing is the same token count marked at a different point. Any dollar figure here is a snapshot, and the token count is the firmer number.
A timeline that outran the disclosure
Investigators identified the first sweep at 15:35 UTC on Sept. 15. DCENT logged its first customer complaint the next day, from a user in Korea, and began notifying users through its app and official channels on Sept. 16. The company had already issued warnings about unauthorised transfers involving its mobile App Wallet.
The draining did not stop. Another collection wave began at 07:05 UTC on Sept. 17, and the report describes the activity resuming with renewed intensity rather than tapering off, with the attackers appearing to adjust their pace around detection efforts. For anyone holding a DCENT wallet during that window, vendor notification was not protection.
The exit route was planned in advance
The laundering path is the clearest sign this was not improvised. Funds moved through THORChain, NEAR Intents and Binance. THORChain bridges value to other chains, which breaks a single-ledger trace. NEAR Intents adds another hop. Binance introduces a centralised custodian, where recovery depends on an exchange freezing an account rather than on on-chain forensics.
The speed of those transfers points to routing that was mapped before the first AccountDelete was signed. Mixed cross-chain and centralised venues also split the recovery problem into pieces with different owners, which is exactly the effect an attacker wants.
Recovery is not always hopeless. In a separate wallet incident, white-hat hackers redirected $4.4 million in Bitcoin from a Coldcard exploit into a victim recovery trust, thebitgazette.com reported. That outcome depended on funds staying reachable. Assets pushed through THORChain and into an exchange are a harder case.
The second wave is social
DCENT has warned users about impersonators exploiting the incident, which is the predictable follow-on to any large drain. The company said it will never ask for a recovery phrase, private key or PIN, and will not provide a wallet address that users must send assets to in order to receive recovery or compensation. Treat any message asking for those things as hostile, regardless of what it claims about your account.
What to Watch
DCENT said on Sept. 20 that it was still developing a process for determining the scope of impact and the status of affected assets, so the first thing to watch is that process being published: how affected accounts are identified, and what the company is prepared to say about cause. The second is attribution of the root vector. Nothing in the reporting so far explains how keys for 6,678 separate wallets became usable by one operator, and until that is answered, the practical scope of the breach is unknown.
