XRP wallet exploit triggers Web3 security alert

TLDR

An exploit involving the DCENT App Wallet has led to millions of XRP and other assets being drained and triggered a broader Web3 security warning.

1. A vulnerability in the DCENT software wallet led to abnormal transfers across multiple chains, including XRP Ledger, with about 9.3 million XRP linked to the incident.
2. Only users who used the DCENT App Wallet (or entered a hardware wallet seed into it) are at direct risk, and the provider urges immediate checks, updates, and asset moves to new wallets.
3. The case highlights growing Web3 key?handling risk, with token issuers freezing affected trust lines and security teams investigating how wallet and infrastructure keys are being compromised.

Deep Dive

1. What Was Exploited

Reports say Korean wallet provider DCENT detected abnormal transfers from its software DCENT App Wallet and issued an urgent security alert for XRP and other chains, including XRPL, Bitcoin, Ethereum, and TRON.

According to incident coverage, an XRPL intel account has flagged around 6,160 potentially affected addresses and roughly 9.3 million XRP linked to the theft, with about 2 million XRP still in tracked wallets and 7 million XRP sent to unidentified services. Affected wallets also hold Ripple USD (RLUSD) and other XRPL tokens, and issuers have been urged to freeze compromised trust lines where possible to limit further movement of stolen assets.

The exploit appears to target how keys or recovery phrases were handled in the DCENT App Wallet rather than a flaw in the XRP Ledger protocol itself.

2. Who Is Affected And What To Do

DCENTs alert applies specifically to users who:

1. Use the DCENT App Wallet (software), or
2. Ever entered or restored a hardware wallet recovery phrase inside that app.

The company has told users to update the app to the latest version, use the in?app Check if action is needed function, and, if flagged, move assets out of the DCENT App Wallet to a new secure wallet created with a fresh recovery phrase. They also stress that they will never ask for recovery phrases, private keys, or PINs via support messages, warning about copycat scams around the incident.

3. Wider Web3 Security Implications

This incident lands in a month already filled with multi?protocol key and bridge exploits, where attackers stole millions by abusing compromised signing keys. It reinforces that the critical failure point is often key management in wallets, bridges, or backend services, not the base blockchain.

For XRP Ledger specifically, token issuers have been asked to freeze affected trust lines, especially for assets like RLUSD, to reduce the utility of stolen tokens. For the broader Web3 ecosystem, security teams are watching for: more details on how DCENTs environment was breached, whether similar patterns appear in other wallet apps, and whether further victim addresses emerge.

Conclusion

The XRP wallet exploit is a wallet?side compromise centered on the DCENT App Wallet, not a fundamental break of the XRP Ledger, but it still resulted in millions of XRP and other tokens being drained. The main lessons are to minimize where you ever enter a seed phrase, rely on official wallet guidance when incidents occur, and pay attention when issuers or security teams flag specific wallets, trust lines, or apps as risky.