The D'CENT Drain, Day by Day: 12.7 Million XRP, Six Waves, One List of Keys

• 15 September opened by hand at 15:35: 8 wallets holding 99,999 XRP or more, 1,608,506 XRP, into five fresh addresses, an hour before any script ran. The script followed at 16:29 in two batches, with a 34-minute pause in which the 12 richest of the remaining wallets were moved by hand. Batch 1 got the reserve arithmetic wrong; batch 2 had it right to the drop. 1,682 wallets were swept that day, 3,618,110 XRP; the first version of this article counted 1,548 wallets and 2,009,321 XRP, because it had not found the early by-hand sweeps and skipped wallets that lost under 1 XRP.
• 16 September, the day of D’CENT’s first notice, was the only quiet day. From 07:05 on the 17th, five more waves into five new collector addresses took 2,532 more wallets and 7,597,207 XRP, the last sweep at 20:56:41 on the 20th. Wave 5 was the day-one script itself, unchanged; wave 6 opened with the by-hand tool’s tag. The deletion sinks took payments as well: 531 wallets, 16,021 XRP, from the 18th.
• From the morning of the 17th the keys were used a second time: 6,276 accounts were deleted for the reserve each one held, 1,618 of the 1,682 day-one wallets among them, and 2,750 wallets that had never been swept were deleted with whatever they held, 107,507 XRP in one case.
• It did not stop on the 20th. From 21 September to 1 Oct 11:07 two new collectors took 681,765 XRP from 18 wallets, five new sinks took 1,275 deletions, and 112 wallets that had been emptied and then refilled lost what had been put back. 580 of the 1,407 wallets hit in those days had not been touched before.
• From 27 Sep, five more accounts took 5,931 accounts and 266,261 XRP and deleted 5,880 of them: 1,043 emptied earlier in this incident, emptied again, and 4,888 never touched before. Their money leaves by other services; they are in the totals above and have their own section.
• The money left the XRP Ledger fast. 6,955,091 XRP went into THORChain with swap memos naming 5 Ethereum addresses; 3,255,917 into unionchain.ai, a custodial service; 546,080 into NEAR Intents; 559,093 into Binance deposit tags. 778,447 XRP still sits in the wallets that took it, 510,111 of it in the first by-hand collectors of 15 September. The collector opened on 22 September held its 681,830 until 29 Sep, then swapped it to Ethereum.
• The later victims are the same kind of wallet as the first: ordinary accounts first funded from an exchange, Uphold and Coinbase first this time. Unlike the day-one list, whose youngest wallet dates from 5 Feb 2025, the later waves reached 603 wallets created in 2025. The victims’ own earlier transactions are almost all untagged, so the ledger does not name the app; D’CENT’s status report does.
• The by-hand tool carries the source tag of a consumer wallet app in wide use: 102,868 accounts in our index were activated by payments carrying it since March 2025, from 80,455 different wallets, and 3 of the day-one victims had used it themselves for ordinary payments in 2025. The ledger does not say which app it is.
• Our own list had the script’s day-one collector 31 seconds in and every collector of waves 2 to 6 within minutes of its first sweep; the six by-hand collectors of the 15th, which take one to four wallets each, are what fan-in detection cannot see. The addresses are at the end.

Nothing here required an exploit of the XRP Ledger. Each wallet signed an ordinary payment of nearly its whole balance, and later an ordinary deletion. The ledger shows what the keys did and when; it cannot show how they were obtained.

The first attempt on the wallet rQpTpg…jcaK came at 16:30:21 and asked for 49,206.577956 XRP from a balance of 49,207.577956: balance minus one XRP, to the drop. The wallet owns 1 object, so its reserve is 1.2 XRP and the ledger refused. The script tried the same sum 2 more times, at 16:32:10 and 16:50:21, and failed each time. At 17:12:30 the wallet was emptied by hand instead. 97 wallets failed at least once on the 15th; 86 of them were collected later that day, the first by batch 2’s opening payment at 17:17:40.

The corrected formula tells you what the operator learned in those 34 minutes: the owner reserve, and the fee. Batch 2 leaves exactly the reserve behind on 1,456 of its 1,469 sweeps; the rest differ by the fee of a retried payment. Both batches pay 10 drops per transaction and set the same fields; it is one program, edited once. Three days later that same program, with the same fee and the same formula, opened wave 5 and left the reserve to the drop on 1,061 of 1,067 sweeps.

The tool that moved the twelve is not the script. Its payments carry a SourceTag, 1741383633; pay a 20-drop fee instead of 10; set their expiry ledger to the current ledger plus the account's own sequence number, which is a bug no library makes; and leave exactly twice the reserve behind, the way an app with a safety margin does. They arrive 10 to 30 seconds apart, at typing pace, with a four-minute break after the sixth. The same tool created the operator's own provisioning wallet rf3v2W…HEez on 22 August; 23 of the 26 wallets that one funded fed the laundering hub. On 19 September it cashed the twelve’s 730,954 XRP out, and opened wave 6 with 50 sweeps.

It had also opened the day. Between 15:35 and 16:14, before the script’s first payment, the same tool moved the 7 largest wallets of the whole list, from 510,108 down to 99,999 XRP, into four fresh addresses, and at 18:55 one more, 154,998 XRP, into a fifth. Three of those addresses were cashed out on the morning of 19 September with the same 5,000-drop fee as the rest of the operator’s cash-out payments; rh95U2…QDNb still holds its 510,108 XRP. The script visited two of them at 15:59 with five small wallets, so the two tools were working the same list an hour before the script started in earnest.

The batch-2 script later visited all twelve and took the second reserve the tool had left, 1 to 4 XRP each, between 17:36:51 and 18:31:50. It did not know they had been handled; it was still working from its list.

Every wallet the script emptied was dusted with 10 drops 20 to 40 seconds afterwards. That is not the operator: the 47 wallets doing it have dusted 6,208 addresses since at least 12 September, exchange deposit addresses included, after any sizeable payment they see. Nothing the operator controls touched a victim before its sweep. The later waves were walked in other orders: wave 6 from the largest wallet down, waves 2, 3 and 5 in no order the ledger can name.

Three things tie the later waves to the first. Wave 5’s collector rQKqEk…tgwY was filled by the day-one script exactly as batch 2 ran it: the same 10-drop fee, the reserve left behind to the drop on 1,061 of its 1,067 sweeps. Wave 6’s collector rJSo9y…9yuV opened with 50 payments carrying the tag and the 20-drop fee of the tool that moved the twelve. And the wallets emptied on the 15th were deleted, with their own keys, into wave 3’s collector rU5k4s…a7At, 1,283 of them; a script cannot do that without the key the sweep used.

Waves 2, 3 and 4 used two more tools. Wave 2’s script pays the fee the operator’s own cash-out payments pay, and its whole take went to Ethereum through the same THORChain vaults wave 5 used the next day. Waves 3 and 4 share a third tool that leaves a fixed margin above the reserve; 4 of wave 3’s wallets were day-one victims that had been refilled since. Wave 3 also read like the twelve: 109 of its 130 wallets held over 1,000 XRP, the largest 290,069, and its collector is the only one the operator funded before the first sweep rather than letting the first sweep create it.

A user who wrote to D’CENT on X put it plainly: “my account wasn’t drained until late on 9/17.” The later waves fell on wallets whose owners had had the notice for a day or more.

An XRP Ledger account that owns no trust lines or other objects can be deleted by its own key; the reserve it was holding, minus a 0.2 XRP fee, goes to an address the deletion names. From 10:22 on 17 September the operator did this to the wallets it had already emptied: 137 into the day-one collector in 68 minutes, then 1,283 into wave 3’s collector, 875 of them in a single hour, then 2,742 more into 17 fresh sinks between the evening of the 18th and midday on the 20th, and from 22 September 1,275 into 5 newer ones. In all, 6,276 deletions carried 532,728 XRP.

1,618 of the 1,682 wallets emptied on the 15th are gone this way, 1,249 of the 2,532 emptied in the later waves, and 508 that had been emptied into a sink first. The other 2,750 deleted accounts had never been swept at all. 2,429 of them held under 5 XRP, 2,194 XRP between them: the reserve and little else, wallets that were dormant or whose owners had already moved out and left the minimum behind. The remaining 321 held 519,022 XRP between them and were simply deleted whole, 28 of them above 1,000 XRP; the largest, a wallet in use since 2022, lost 107,507 XRP in one deletion. Deleting a wallet is worth about 1 XRP to the thief and costs the owner the account itself: the address cannot be reused without paying the reserve again, and every trust line and tag that pointed at it is dead.

The sinks were not only for deletions. From 18 Sep 22:46 531 wallets were emptied into them by payment, 16,021 XRP; 446 of those wallets no collector had touched.

Which is also the clearest proof of one operator. A deletion can only be signed by the account’s own key, so every one of those 6,276 accounts was on the same key list as the sweeps, and the list reached wallets the sweeps never touched.

The six waves ended on the 20th; the list of keys did not. From 21 September to 1 Oct 11:07 the keys were used on 1,407 wallets: 580 for the first time, 112 that had been emptied before and refilled since, and 715 emptied earlier and only now deleted. Two new collectors took 681,765 XRP between them. rpCKev…5rHq kept its take until 29 Sep 07:27, then paid 681,830 XRP into THORChain with a memo naming an Ethereum address none of the earlier swaps had used. Wave 5’s collector paid into the first, and the first paid its take into the second, so both are the operator’s.

Refilling an emptied address does not make it safe: whoever holds its key takes what arrives. 112 wallets lost XRP that way after the 20th, 4,832 XRP between them. D’CENT’s status report tells users not to reuse an old address “for any purpose, including deposits”; this is why.

From 27 Sep 07:12 to 4 Oct 11:05, five new accounts took 5,931 accounts and 266,261 XRP. 1,043 of those accounts had been emptied earlier in this incident and were emptied or deleted a second time; 4,888 had never been touched. Only an account’s own key can delete it, so whoever runs these five holds the keys of 1,043 accounts on this list.

They open the way the earlier collectors did, with money from a wallet that is then emptied itself. r9f7gZ…bwdk was created by 10,155 XRP from rGJT8i…G8Za, a wallet in use since 2024, which was itself deleted into the third account on 1 Oct. The third, rwNSxP…ho5s, was created by rhLnTe…aoMw 12 minutes after that wallet had paid 1.2 XRP into the second; it then opened the fourth, and the fourth the fifth. rP2RPt…sAjD was opened 11 hours before the second, by 1,231 XRP from another wallet in use since 2024.

The 4,888 accounts never counted before look like the rest. They were first funded from the same exchanges in nearly the same order (Uphold, Coinbase, Binance, ChangeNow and Bitrue), and 4,838 of the 4,888 whose first transaction we read date from 2021 to 2025. 4,842 were deleted for what they held and 812 paid out, 766 of them both. The ledger does not show where their keys came from.

Their money does not reach any wallet above. 158,714 XRP went straight into FixedFloat, a swap service, and wallets made the same week passed on 29,998 more to FixedFloat and ChangeNow and 22,923 to Binance deposit tags; 82,247 XRP went out to a fresh wallet and came straight back. 44,594 XRP is still in the five accounts and the wallets they paid.

The totals at the top include these five. They took 4,888 accounts the earlier waves had never reached, and they cash out by another route. Whoever runs them holds keys of D’CENT App Wallet victims; whether it is the same operator, the ledger does not say.

Most of it is no longer XRP. Waves 2 and 5, later the parked wallet and, on 29 Sep, the collector opened on 22 September paid 6,955,091 XRP into THORChain’s XRP vaults in 50 deposits, each carrying a swap memo of the form =:e:0x…, THORChain’s instruction to deliver ether to an Ethereum address. 5 addresses received it:

• 0x423c7ADc42e52069859Da68b957DB9cD8C08C173: 2,725,730 XRP from wave 2, in 31 deposits, 17 Sep 18:02 to 18 Sep 02:01.
• 0x83bD5c260dB20EA4638ac6B70B4f07B321460aa9: 470,800 XRP from wave 5, in 3 deposits, 18 Sep 16:18 to 17:05.
• 0xC1D6DA33D20975caF91E0E8dBf5d50d0f51E5433: 2,398,000 XRP from wave 5, in 2 deposits, 20 Sep 21:45 to 21:45.
• 0xD65Cd77D42a5A7d5b2Ae2Ae0Ca2AEfe9e1079fE1: 678,731 XRP from the parked wallet, in 13 deposits, 21 Sep 09:24 to 23 Sep 17:20.
• 0x4a1b6742D95F9C57C5522fA78B3D52851d876f35: 681,830 XRP from the collector opened on 22 September, in 1 deposit, 29 Sep 07:27 to 07:27.

The rest went to exchanges, swap services and a custodial service in the ordinary way. Wave 3’s 1,580,114 went to unionchain.ai on the 18th, and the twelve’s 730,954, the hop’s 653,475 and 793,352 of the early by-hand collectors’ money, parked since the 15th, followed it there on the 19th after moving through fresh wallets. Wave 6’s take went into NEAR Intents within 13 minutes of its first sweep. The day-one collector’s 410,019, the spare 14,999 and 214,996 of the hop’s money gathered in raG99z…GVYn, a wallet created on the 18th by rsXXQH…WeT5, which had been funded on 12 Sep, before the first sweep. The parked wallet paid 707,486 XRP into THORChain on the 21st and 23rd, all to the fourth Ethereum address, and on 26 Sep moved its last 28,755 XRP to a new wallet, rPviCb…a634, which still holds it.

The hub rLBpP3…Ctcb predates this incident. It was created on 9 August by a KuCoin withdrawal and had passed 1.36 million XRP by the 16th, all of it from freshly made wallets, 418 of its 502 inflows account deletions. Earlier hubs of the same shape ran from 7 July, 16 July, 28 July and 29 July; the 16 July one, rsoATt…kZQW, took the remainders of the by-hand cash-outs above; on 23 Sep it paid out to a Binance deposit tag and deleted itself into the same address. Whatever this operation is, the week of 15 September was its biggest by far, not its first.

The ledger does not name the app the victims used. Of the 25,887 transactions the day-one wallets had signed before the first sweep, 25,755 carry no source tag at all; 16, from 3 wallets, carry the by-hand tool’s tag; the rest carry the tags of a few DEX and NFT apps. The later-wave wallets look the same: 31,574 of their 31,899 earlier transactions are untagged and 48 carry the by-hand tool’s tag. No two victims are linked on chain except through whatever they had in common off it.

D’CENT’s notice of 16 September reported abnormal transfers involving its App Wallet and said hardware wallets were not affected. Its status report, dated 17 September, gives the criteria: a recovery phrase that was at some point entered into the App Wallet, a history of signing, an app version below 8.1.0 at the time of signing, on any of Bitcoin, Ethereum, XRPL, TRON and the EVM chains; and it says the matter is with Korean law enforcement and that it is asking exchanges to freeze what they can. On 20 September it told App Wallet users to take action now, and on the 21st that it has no confirmed outcome on reimbursement. On the 23rd it said it was still working with law enforcement and exchanges “to trace the transferred funds and pursue freezing measures.” Accounts posing as D’CENT support have been answering victims on X with offers of a “reimbursement plan”; D’CENT says its only accounts there are @DCENTWALLETS, @DCENTWALLETS_KR and @DCENTWALLETS_JP. The ledger neither confirms nor contradicts any of it: it shows one list of keys used from one place across 17 days, in waves, with the largest handled by hand, and it shows the money leaving through THORChain within hours of each wave. How the keys reached that place is the question the app matters for, and we have read the app.

On our side, the day-one collector was blocklisted 31 seconds after its first inflow and confirmed at 17:26 on the 15th; the second, which took the twelve, was not caught, because its first sweep was so large that our rule read the address as an institution. Since 16 September a whole-balance sweep fan-in trips on ten wallets and 100,000 XRP as well as on twenty-five wallets, and every later collector was listed within minutes of its first sweep: wave 2 at 07:07, wave 4 at 11:02 and wave 5 at 15:14 in the minute they opened, wave 6 at 14:17, wave 3 at 20:44, 33 minutes after its first large sweep. The seventeen sinks of 18 and 19 September were listed the same way. The script’s collectors and those sinks are on our scam list, which wallets can check before signing; the by-hand collectors, and the collectors and sinks opened since 21 September, are not on it yet. A listing stops a wallet that asks; it does not stop a key the thief already holds.

The by-hand collector was shared publicly by James Rule XRP (@allthemoney) on 16 September at 11:51 UTC, sent to him by a community member who had been drained into it. Everything else here was found by following that one address, and then the keys.

• Day one, by hand first: rh95U2DR3hfxroQQAgBCfNa7kegsxDQDNb · rhmXNwW4yKNKWSNK3fRiDzryKFfoGY3z8k · rf8wYMwmcCsxTQp1iC2u5JyzvMfa7QauqN · rE6CTY5iegdswf6mnomEKVbXsttCi7K2y · rwBwd84X7wUQqvDbCqJptGXHnYrLLLN697
• Day one, script: rDT8UPJM1Xd1MVbDi1R2bZH17MHWuvwPui · the twelve by hand: rDAeWP5LfAzwBMvJZruCSzaWVF9sz9oXzj
• Wave 2: r9NqRaFEM2Y73Cqq2sxCuzbBJCLDmZJREg · wave 3: rU5k4sSU9HN5c1Mpe2GhKmFXcdNX5ta7At · wave 4: rU9SywNk6Uky8JxCXn5NcCrNx7QpWdbdHt
• Wave 5: rQKqEk7j1bKijfW8yiSjUMYqWVZMpUtgwY · wave 6: rJSo9yfhWzxwXMBaYWMbLhZML3cA9E9yuV
• Hop: rE6Mxn7rTUUu7y1HqFnRMb6NJwSBBAi9UL · spare: rwWnFecB6jFAdaKHbA6GUYCaem477zc32v · to Bridgers: r91LKBRnVr7HBXjLRdxQ1WfUQ6FUAXSxFR · parked: raG99zqNNDAwGDE7j8NDxFkKeEknVcGVYn
• Hubs: rLBpP3xKScTobDiXv16CvBC1G6X5JdCtcb · rHQMDzcxz6YgC2STnzGcDSDNfC6bP61D54 · rsoATtUzgMYHgc81QcmVsTikuoRgZMkZQW · first deletion sink: rDYh21w6TGm1f6CaCe56uBnXFrUexDoRiH
• Provisioning wallet: rf3v2WVUrxgpT6KxuepJHYFeFnLECTHEez · unionchain.ai: rJzNqvafEN6mPXykTTWz7f2Xfz5uXHAsRF
• After 20 September, collectors: rwDHgLsKgAGBP8MsaPnnNFmdZJ4HbrZiTz · rpCKevucq3AQAmrLiDefTiViHWn3jS5rHq · sinks: rJV8eXVCHwxGc4jFEDrwE1kA2ZZp3tgvqE · raCafkxgSZrWFG73XQbCR8Pa5E9PdeX1e3 · rEXwbeQzEPugoHUgr7buAfWxXHc8XUZbix · rsupt7sQyV2LAKXwKGbLqidNGFYZLLusFo · rLwMPnvR8ReBLt8qapT7Ek6jHKxDMGHFnt · the wallet that created the parked one: rsXXQHHKEZKW34yCshWiiLWTCyCiWoWeT5
• From 27 September, the five: rP2RPtgateLLL8fZTiZGnEECd2gwgpsAjD · r9f7gZLKRbG1UFmirg35WMtXmyqYHhbwdk · rwNSxP3bbQUa86sbdocMWQRofsyEiyho5s · r31h7q3eUs7UD274bS3XJrj8qDus8cYUXm · rZhwQepo6Mu2TYzmA1UFreYXbfRRYJ1hy · opened by the second's first payment · paid into the second · opens the third
• Ethereum: 0x423c7ADc42e52069859Da68b957DB9cD8C08C173 · 0x83bD5c260dB20EA4638ac6B70B4f07B321460aa9 · 0xC1D6DA33D20975caF91E0E8dBf5d50d0f51E5433 · 0xD65Cd77D42a5A7d5b2Ae2Ae0Ca2AEfe9e1079fE1 · 0x4a1b6742D95F9C57C5522fA78B3D52851d876f35
• First sweep, by hand 1C9D03ABA5… · the script starts 05136ACDA2… · first failure 0628003C05… · first by-hand sweep FFC37873B5… · batch 2 opens 44F8B4D10C… · the hop 5385E40363… · first Binance deposit B86287DCA0… · Bridgers 75A3CC71CA…
• Wave 2 opens A83E3EEBA7… · first deletion 33986A6970… · largest sweep F618D447D3… · first THORChain deposit A903207604… · wave 5 opens 6788B137FB… · wave 6 opens 983E89D487… · 1,200,000 to THORChain 19277E1878… · last sweep of the six waves 721844BF68…
• First new collector opens 50DC73DDE4… · wave 5 pays into it 7CC6024FAD… · second new collector opens 67D1C55812… · 11,415 XRP into a new sink E9B5514345… · the parked wallet to THORChain 304C362B01… · the 22 September collector to THORChain B3E3E2C6F9…

Times are ledger close times. Amounts are what the ledger delivered. If you hold one of these wallets, the whole sweep is visible from its own page on any explorer; if the page says the account does not exist, it was deleted, and the deletion is the last transaction in its history. Figures re-derived from the ledger on 2026-10-04 15:34 UTC.