XRPL fraud & scam intelligence 🔎 On-chain investigations • Address attribution • Scam alerts Making the XRP Ledger safer.
XRPL
Joined September 2026
- Tweets33
- Following63
- Followers78
- Likes58
The 233M XRP stolen from Binance, worth approximately $291.5M, remains untouched in this account:
rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx
bithomp.com/account/rK21t6nG…
#XRP #Binance
Final Bitget investigation update:
Most stolen $XRP went through THORChain and was converted to BTC/ETH, ending up across 110 BTC and 8 ETH addresses.
We reported all traced wallets and findings to the Bitget investigation team.
This is what the flow of the stolen funds looks like now.
It all started with one wallet:
rwNhefsz1UQEusxhCvHip3RANinWi4CTck
We continue tracking the flows, and we report all findings to @bitget.
5 THORChain swap services are currently being used to move the stolen @bitget funds cross-chain.
Over 67.6M XRP (~$104.6M) has already been swapped through THORChain into BTC, ETH, and Base.
Most of it — 62.5M XRP (~$96.6M) — went into BTC swaps.
Almost half of Bitget’s stolen XRP funds have now moved from the original 5 wallets.
The stolen XRP is being laundered, mostly through @THORChain → moved cross-chain into BTC and ETH.
5.4M XRP has left one of the wallets and is now being laundered.
We’re seeing the same unidentified services used to move the funds as in the D’CENT case.
Some of the funds are also ending up at @Bridgersxyz . We’re tracking the flows.
The full picture of the 102.9M XRP stolen from Bitget.
Most of the funds are still sitting in the receiving wallets. Only one of the accounts has started moving its XRP.
We are investigating the case and tracking the funds.
⚠️ SCAM ALERT: Fake D’CENT emails claim your device “missed its update window.”
The link takes you to a page offering a “Slack” download for your OS.
DO NOT download or install it. It is not a legitimate D’CENT update.
Delete the email and stay safe.
Over 800K XRP has been stolen in the last 30 days through malicious NFT Buy offers pushed via fake airdrop websites.
Be careful. Always check exactly what you’re signing, and never blindly sign transactions pushed to your wallet.
D’CENT App users: check whether you are affected. If you are, move your funds to a newly created secure wallet as soon as possible.
One of the easiest and fastest options is @XamanWallet.
D’CENT Update — Sep 22, 03:15 UTC
• 7,059 potential victims
• 12.02M XRP received from potential victim addresses
• 1.44M XRP still held in tracked scam wallets
• 10.02M XRP sent to unidentified services/wallets
• 1.27M XRP sent to identified services
⚠️ WARNING: Fake D’CENT security emails are circulating.
Do NOT trust emails just because they mention the recent D’CENT incident.
Do not reply, click links, or share your recovery phrase. Always verify instructions through official D’CENT channels.
🚨 D’CENT Update — 20 Sep, 00:14 UTC
• 6,160 potential victim addresses
• 9.3M XRP collected from potential victims
The tracked funds are mixed with XRP received from other sources.
• 2M XRP still held in tracked wallets
• 7M XRP was sent to unidentified services
🧵 1/2
Two wallets have been identified where issued tokens stolen from D’CENT App users were collected:
rQKqEk7j1bKijfW8yiSjUMYqWVZMpUtgwY — holds RLUSD
r9NqRaFEM2Y73Cqq2sxCuzbBJCLDmZJREg — holds multiple XRPL-issued tokens
1/2
D’CENT Update — Sep 18, 22:34 UTC
• 3,548 potential victims
• 8.8M XRP received from potential victim addresses
• 3.2M XRP still held in tracked scam wallets
• 5.8M XRP sent to unidentified services/wallets
• 292K XRP sent to identified services