XRP wallet breach exposes 9.3M XRP stolen

TLDR

A security breach in the DCENT App Wallet led to roughly 9.3 million XRP being stolen from user wallets, affecting thousands of addresses.

1. A DCENT App Wallet security incident exposed recovery phrases and enabled attackers to drain about 9.3 million XRP across roughly 6,160 addresses.
2. The issue is tied to DCENTs software App Wallet and reused recovery phrases, not to the XRP Ledger itself or untouched hardware wallets.
3. The key things to watch are DCENTs investigation, exchange responses, and whether users rotate to new recovery phrases and safer wallet setups.

Deep Dive

1. What Happened And How Big It Is

DCENT, a Web3 wallet provider, reported abnormal transfers from its software-based App Wallet and issued a major security alert for XRP and other chains. XRPL-focused outlets describe the incident as a significant breach for South Korean XRP users, a major market for the token.

An intelligence account tracking the theft identified about 6,160 potentially affected addresses and estimated that roughly 9.3 million XRP had been stolen. According to this analysis, about 2 million XRP still sit in tracked wallets, while around 7 million XRP have already been sent to unidentified services, making recovery harder. These details were summarized in a DCENT-focused incident report and follow up coverage on a major security alert.

The affected wallets span multiple networks, including XRP Ledger, Bitcoin, Ethereum, TRON, and other EVM chains, reflecting that the breach targeted key material, not a single chain.

2. Who Is Affected And What Failed

DCENT has emphasized that the problem appears confined to its App Wallet, particularly where users imported or restored recovery phrases into that app. App versions below a specific threshold were singled out as risky, especially if they had a history of signing token transfers, NFT transfers, approvals, or dApp interactions.

Hardware wallets that never had their recovery phrase entered into the DCENT App Wallet have not been flagged as compromised. The XRP Ledger itself continues to function normally, and there is no indication of a protocol-level exploit. Instead, this is a classic key-compromise scenario: once a recovery phrase is exposed through vulnerable software, any asset controlled by that phrase is at risk.

Token issuers were also urged to freeze affected trust lines where possible, including for RLUSD, to slow down movement of stolen assets. That shows how wallet breaches can spill over into stablecoins and other tokens sitting on XRPL.

3. What To Watch And Risk Signals

DCENT has advised users to update the App Wallet to the latest version, run its built-in check if action is needed function, and, where appropriate, move funds into a new wallet created with a fresh recovery phrase. These steps aim to cut attackers off from compromised keys while keeping unaffected users from panicking unnecessarily.

The company says it is working with exchanges and law enforcement to trace stolen funds and identify collection wallets. Exchanges may help by monitoring and freezing obvious hacker-controlled addresses when they attempt to cash out, but the 7 million XRP already routed to unidentified services suggests some funds may be laundered.

Looking ahead, the main risk signals are: continued reports of new drains tied to old DCENT phrases, phishing campaigns that exploit the incident, and whether users keep reusing compromised mnemonics across multiple wallets or apps.

Conclusion

The theft of about 9.3 million XRP stems from a DCENT App Wallet security failure that exposed recovery phrases, not from a flaw in the XRP Ledger itself. The immediate impact falls on users who reused seed phrases in the vulnerable app, while the broader lesson is that companion software and key reuse can silently undermine even strong hardware wallets. Watching DCENTs remediation, exchange actions, and user migration to fresh recovery phrases will be key to gauging how much damage ultimately becomes permanent.