Nearly $20 million in XRP was drained from 6,678 wallets across six attack waves between Sept. 15 and Sept. 20.
More than 5.6 million XRP then moved through THORChain. The transactions were validly signed, but investigators still do not know how the attackers got the keys.
https://cryptoslate.com/nearly-20-million-in-xrp-drained-from-6678-wallets-across-six-attack-waves/