XRPL Intel

XRPL fraud & scam intelligence 🔎
On-chain investigations • Address attribution • Scam alerts
Making the XRP Ledger safer.

[XRPL Intel @xrplintel]

This is what the flow of the stolen funds looks like now.

It all started with one wallet:
rwNhefsz1UQEusxhCvHip3RANinWi4CTck

We continue tracking the flows, and we report all findings to @bitget.

[XRPL Intel @xrplintel]

5 THORChain swap services are currently being used to move the stolen @bitget funds cross-chain.

Over 67.6M XRP (~$104.6M) has already been swapped through THORChain into BTC, ETH, and Base.

Most of it — 62.5M XRP (~$96.6M) — went into BTC swaps.

[XRPL Intel @xrplintel]

Almost half of Bitget’s stolen XRP funds have now moved from the original 5 wallets.

The stolen XRP is being laundered, mostly through @THORChain → moved cross-chain into BTC and ETH.

[XRPL Intel @xrplintel]

5.4M XRP has left one of the wallets and is now being laundered.

We’re seeing the same unidentified services used to move the funds as in the D’CENT case.

Some of the funds are also ending up at @Bridgersxyz . We’re tracking the flows.

[XRPL Intel @xrplintel]

The full picture of the 102.9M XRP stolen from Bitget.

Most of the funds are still sitting in the receiving wallets. Only one of the accounts has started moving its XRP.

We are investigating the case and tracking the funds.

[XRPL Intel @xrplintel]

At least 102.9M XRP — worth around $158M — was stolen from the Bitget exchange.

[XRPL Intel @xrplintel]

⚠️ SCAM ALERT: Fake D’CENT emails claim your device “missed its update window.”

The link takes you to a page offering a “Slack” download for your OS.

DO NOT download or install it. It is not a legitimate D’CENT update.

Delete the email and stay safe.

[XRPL Intel @xrplintel]

Over 800K XRP has been stolen in the last 30 days through malicious NFT Buy offers pushed via fake airdrop websites.

Be careful. Always check exactly what you’re signing, and never blindly sign transactions pushed to your wallet.

[XRPL Intel @xrplintel]

@ShortTheFOMO You can DM us.

[XRPL Intel @xrplintel]

D’CENT App users: check whether you are affected. If you are, move your funds to a newly created secure wallet as soon as possible.

One of the easiest and fastest options is @XamanWallet.

[DCENT Wallet @DCENTWALLETS]

DCENT App Wallet (software wallet) users: please take action now.

Update the app, check whether action is required, and move your assets if needed.

Please share this notice with anyone who may still be using the App Wallet. https://t.co/DScmkYb6qO

[XRPL Intel @xrplintel]

D’CENT Update — Sep 22, 03:15 UTC

• 7,059 potential victims
• 12.02M XRP received from potential victim addresses
• 1.44M XRP still held in tracked scam wallets
• 10.02M XRP sent to unidentified services/wallets
• 1.27M XRP sent to identified services

[XRPL Intel @xrplintel]

⚠️ WARNING: Fake D’CENT security emails are circulating.

Do NOT trust emails just because they mention the recent D’CENT incident.

Do not reply, click links, or share your recovery phrase. Always verify instructions through official D’CENT channels.

[XRPL Intel @xrplintel]

993K XRP has been traced to the following identified services:

NEAR Intents • KuCoin • Bridges • ChangeHero • Binance • FixedFloat • WhiteBIT • THORChain

🧵 2/2

[XRPL Intel @xrplintel]

🚨 D’CENT Update — 20 Sep, 00:14 UTC

• 6,160 potential victim addresses
• 9.3M XRP collected from potential victims

The tracked funds are mixed with XRP received from other sources.

• 2M XRP still held in tracked wallets
• 7M XRP was sent to unidentified services

🧵 1/2

[XRPL Intel @xrplintel]

⚠️ Token issuers are advised to freeze the affected trust lines to prevent the scammers from moving these assets.

The D’CENT team can provide police reports and other supporting documentation required for issuers to take action.

2/2

[XRPL Intel @xrplintel]

Two wallets have been identified where issued tokens stolen from D’CENT App users were collected:

rQKqEk7j1bKijfW8yiSjUMYqWVZMpUtgwY — holds RLUSD

r9NqRaFEM2Y73Cqq2sxCuzbBJCLDmZJREg — holds multiple XRPL-issued tokens

1/2

[XRPL Intel @xrplintel]

Some funds are being moved cross-chain via Bridgers.

We identified 12 transactions totaling ~118.4K XRP routed through Bridgers:

• Solana — 11 transactions (~99.7%)
• Ethereum — 1 transaction (~0.3%)

[XRPL Intel @xrplintel]

D’CENT Update — Sep 18, 22:34 UTC

• 3,548 potential victims
• 8.8M XRP received from potential victim addresses
• 3.2M XRP still held in tracked scam wallets
• 5.8M XRP sent to unidentified services/wallets
• 292K XRP sent to identified services

[XRPL Intel @xrplintel]

@allthemoney @DCENTWALLETS https://t.co/IAYtjfpAVI

[XRPL Intel @xrplintel]

D'CENT incident update • 18 Sep, 07:33 UTC
• 2,789 potential victims
• 8.2M XRP received by the initially identified wallets
• 5.7M XRP remains in tracked wallets
• An estimated 2.5M XRP reached exchanges and swap services
Exchanges are being notified.

[XRPL Intel @xrplintel]

D'CENT incident update • 18 Sep, 07:33 UTC
• 2,789 potential victims
• 8.2M XRP received by the initially identified wallets
• 5.7M XRP remains in tracked wallets
• An estimated 2.5M XRP reached exchanges and swap services
Exchanges are being notified.

[XRPL Intel @xrplintel]

🚨 D’CENT Incident — On-Chain Findings

Our analysis of XRPL activity has identified the earliest transaction associated with the incident on September 15, 2026, at 15:35 UTC.

To date, the primary wallets linked to the activity have received approximately 7.5M XRP.