What happened.
CryptoSlate reported that XRPL.to traced six waves of a wallet-drainer campaign through Sept. 20. The report put the losses at nearly $20 million in XRP across 6,678 wallets.
The record describes the activity as wallet and seed-phrase exposure, including app-level compromise, rather than a consensus failure.
Why it matters.
The report underscores that a hardware device does not remove the risk created when an App Wallet phrase has been exposed. DCENT’s reported guidance is to replace an exposed phrase even when hardware is involved.
For users and wallet providers, the immediate issue is operational security around phrases and app access, not a reported failure of the chain’s consensus.
What to watch.
Watch for independently corroborated tracing, including wallet-level evidence, a clearer account of the six reported waves, or confirmation from the affected wallet and infrastructure providers. Also watch for further guidance tied specifically to exposed App Wallet phrases.
Independent corroboration of the reported loss total, affected-wallet count, attack-wave tracing, and the source of phrase exposure.
Upstream references and independent checks
Digest dated 2026-09-24 · upstream model sonnet. Direct links are matched to all 1 upstream source IDs.
- 1Nearly $20 million in XRP drained from 6,678 wallets across six attack wavesDirect upstream source ·
860f006cbb27d2f18dd8c4c27eb562b04df8b2bc
This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The loss total and attack tracing come from a single outlet relaying third-party tracing, with no independent corroboration in the supplied record.