Nearly $20 million of XRP was drained from thousands of hardware wallets in six waves spanning nearly a week.

Blockchain analysis firm XRPL.to traced 11.75 million XRP leaving 6,678 distinct wallets between Sept. 15 and Sept. 20, including several collection waves after DCENT warned users of unauthorized transfers involving its mobile App Wallet.

At XRP’s current price of about $1.59, the tokens are worth roughly $18.68 million.

XRPL.to dates the first identified sweep to 15:35 UTC on Sept. 15. DCENT said it received its first customer report in Korea on Sept. 16 and began notifying users through its app and official channels that day.

Another collection wave began at 07:05 UTC on Sept. 17, according to XRPL.to, while the final sweep captured in its investigation occurred at 20:56 UTC on Sept. 20.

The investigator counted 4,208 wallets swept through payment transactions and another 2,470 emptied through account deletion without a preceding payment in the dataset it traced. It also identified 5,001 AccountDelete transactions originating from 4,950 wallets, including accounts that had already been partially emptied.

Account deletion allowed whoever controlled the keys to extract balances that ordinary payment sweeps could leave behind. XRP Ledger (XRPL) accounts maintain a reserve while they remain open, but an AccountDelete transaction can close an eligible account and forward its remaining XRP, minus the deletion fee, to another address.

One such deletion moved 107,507 XRP, worth about $171,000 at current prices.