Hackers steal $20M in XRP from thousands of wallets

Hackers siphoned about $20 million in XRP from thousands of hardware wallets worldwide over recent days, blockchain analysts tracking the XRP Ledger reported.

The activity moved funds from many wallet addresses into newly created clusters, then rapidly through intermediary accounts before being consolidated in a handful of destination wallets. Chain tracing indicates some funds were forwarded to services that convert crypto to fiat, while attribution of cash-out endpoints is ongoing.

Investigators and independent security researchers reported the stolen funds appear to have been collected from individual devices rather than from a single corporate custodian. The pattern of drains did not indicate an exploited smart contract or a bug in the ledger; the movements are consistent with exposed recovery seeds or private keys.

How attackers obtained those recovery credentials remains under investigation. Early signals include phishing and social-engineering campaigns aimed at prompting owners to reveal recovery phrases or to connect devices to malicious software. Researchers also identified possible use of counterfeit firmware or tampered USB devices to extract keys during updates or wallet access.

Hardware wallet manufacturers and wallet software providers have been contacted and are reviewing logs and firmware versions. Several vendors issued advisories reminding customers not to share recovery phrases, to verify firmware downloads from official sources, and to enable extra passphrases or security features where available. Affected users were advised to move remaining assets to new, uncompromised wallets after confirming device integrity.

Chain analysis shows the thefts involved both small personal wallets and some larger accounts. The cumulative movement totals roughly $20 million at current market rates. The number of unique addresses affected runs into the thousands, though the exact count of individual victims is still being tallied because some users control multiple addresses.

Some exchanges and on-ramp services have been alerted and asked to freeze or monitor funds that originate from the identified destination wallets. Recovery outcomes have varied in prior incidents, especially when funds are routed through privacy services or converted quickly. Forensic work on transaction timing and metadata is ongoing.

Background: XRP is the native token of the XRP Ledger and is used for payments and trading. Hardware wallets store private keys offline to reduce the risk of remote hacks, but they can be compromised by social-engineering, supply-chain tampering, or user mistakes that expose recovery information.