The XRP Ledger (XRPL) has recorded a 545% month-over-month increase in new accounts, but the surge may not be a bullish sign.
However, the rise appears to have a possible connection to the ongoing D’CENT App Wallet exploit, which has drained nearly 12 million XRP so far.
XRPL New Accounts Hit Seven-Month High
According to on-chain data from XRPScan, a leading XRPL block explorer, the network recorded 11,610 new addresses on Sept. 24, 2026.
This marked the highest daily account creation figure since Feb. 10, when the XRPL recorded 14,857 new accounts. As a result, the latest figure represents a seven-month high in daily wallet creation.
The 11,610 new accounts also represent a 287% increase from the 30-day average of 3,000 accounts. However, the figure remains 62% below the network’s previous daily peak of 30,600 new accounts, recorded on Dec. 2, 2024.
The recent increase started before the latest intraday spike. On Sept. 15, the XRPL recorded 3,485 new accounts, up massively from the 340 accounts recorded toward the end of August.
New account creation then stayed above 3,300 through Sept. 22 before rising to 11,432 on Sept. 23. This marked a 246% increase within 24 hours. The rise continued on Sept. 24, when the network recorded another 11,610 new accounts.
XRPL Network Activity Also Rises
The increase in new accounts has also come as several other network activity measures have risen. Active accounts climbed from 16,526 on Sept. 20 to 25,856 on Sept. 24. The figure had reached 26,466 on Sept. 23, before falling slightly the following day.
The 26,466 active accounts recorded on Sept. 23 represented a 65% increase from the 30-day average of 16,000 active accounts per day. It also marked a 128.5% increase from the figure recorded exactly one month earlier.
Payments have also increased. The XRPL processed 808,589 payments on Sept. 24, down from the 1.074 million payments recorded on Sept. 23. Despite the daily decline, the Sept. 24 figure still represented a 107% increase from the number of payments recorded exactly one month earlier.
However, the rise in network activity has not extended to every metric. The number of active users fell to 175,817 on Sept. 24, marking a 63.8% decline from the reading recorded exactly one month earlier.
D’CENT Exploit May Explain the Surge
The increase in new accounts may have a link to the ongoing D’CENT App Wallet exploit, which has drained nearly 12 million XRP. The attackers have taken millions of XRP from thousands of D’CENT App Wallet accounts after gaining access to victims’ private keys.
Notably, a signing flaw in older versions of D’CENT’s mobile App Wallet allowed attackers to obtain or control the recovery phrases or keys of affected users. The issue mainly affected users who had entered a recovery phrase into the app and then used it to sign transactions.
The vulnerability did not directly compromise hardware wallets unless users had also used the same recovery phrase in the affected App Wallet. Once the attackers gained access to the keys, they created brand-new collector wallets, which were fresh addresses that had not existed before the attacks.
The attackers then used automated scripts, along with some manual transfers, to move victims’ funds into these new wallets in several waves.
They also deleted many accounts after emptying them, and this allowed them to claim the remaining reserve balances and transfer those funds to their newly created addresses. The attackers later swapped a large portion of the stolen XRP for Ethereum.
Sudden Spike in Account Deletions
The creation of these collector wallets may explain why the number of new XRPL accounts has risen in recent times. Meanwhile, account deletions have also increased, providing another sign that the recent activity could relate to the D’CENT exploit.
On Sept. 24, the XRPL recorded 1,159 AccountDelete requests, representing a 1,000% increase from the figure recorded exactly one month earlier. The attackers have contributed to this rise by deleting accounts after draining their XRP during the ongoing D’CENT wallet attacks.
