TLDR
A major security warning has been issued for XRP (XRP) holders using the DCENT App Wallet, after abnormal transfers and multi-million XRP thefts were detected.
- A Korean wallet provider reports a breach affecting its App Wallet, with about 9.3 million XRP stolen across thousands of addresses.
- The issue is wallet-side, not an XRP Ledger hack, and may impact Web3 users on Bitcoin, Ethereum, XRP Ledger, TRON and other EVM chains.
- DCENT urges users to update the app, move assets to a new wallet, and ignore any support messages asking for recovery phrases or keys.
Deep Dive
1. What Happened In The XRP Wallet Incident
A detailed security alert for DCENTs App Wallet reports abnormal transfers and an ongoing investigation into a targeted attack on users of its software wallet, including XRP holders using the XRP Ledger.
According to the alert, around 9.3 million XRP has been stolen, with roughly 2 million XRP still sitting in identified attacker wallets and about 7 million XRP already sent on to unidentified services, across an estimated 6,160 victim addresses. The incident has also surfaced on X, where one post highlights 2,009,321 XRP stolen from 1,552 DCENT-linked wallets in roughly two hours.
Token issuers on XRPL, particularly RLUSD, have been asked to freeze affected trust lines to limit the movement of stolen assets, and two aggregation wallets collecting the stolen XRP have been flagged for monitoring in the alert from DCENT that is summarized by a security report on XRP holders.
2. Why Web3 Wallet Users Should Care
The problem lies in how recovery phrases and transaction signing were handled by the DCENT App Wallet, not in the core XRP Ledger protocol itself. Users who entered or restored a hardware wallet recovery phrase inside the app, or signed transactions on older app versions, are at elevated risk.
Affected addresses include those on multiple networks, including Bitcoin, Ethereum, XRP Ledger, TRON and other EVM chains, because a compromised recovery phrase or signing flow can expose any asset held under that wallet. This makes the incident a broader Web3 security issue, not just an XRP-specific event.
If you rely on third party wallet apps, your main risk is how those apps store and use your recovery phrases and signing keys, regardless of which coin you hold.
3. Recommended Actions And Signals To Watch
DCENTs guidance, as reported in the alert, is to immediately update the App Wallet to version 10.0.0, use the in-app Check if action is needed tool, and follow the instructions shown there before using the wallet again.
Users are advised to move funds out of the compromised App Wallet into a secure wallet created with a brand new recovery phrase, and to treat any old phrase used in the affected app as permanently unsafe. DCENT also stresses that it has no official Telegram or Discord, and will never request recovery phrases, wallet keys or PINs via direct messages, which helps users distinguish real support from scams.
Looking ahead, watch for further official updates from DCENT and XRP ecosystem projects about trust line freezes, recovery options, and any new attacker addresses identified, as well as broader wallet security rules that may emerge in response to incidents like this.
Conclusion
The XRP security alert is a serious wallet level breach centered on the DCENT App Wallet, with millions of XRP and other assets reportedly stolen across several chains.
For crypto users, the key takeaway is that protecting recovery phrases and choosing secure wallet software matters as much as picking strong coins, and that following official incident guidance quickly can materially reduce further losses in similar situations.
CoinsKid.Com