TLDR
A compromise of the DCENT XRP App Wallet led to abnormal transfers and token issuers being asked to freeze XRPL trust lines linked to the attacker.
- DCENT reports abnormal transfers across XRP Ledger and other chains, with about 9.3 million XRP stolen and over 6,000 potentially affected addresses identified.
- Freeze requests target XRPL-issued tokens such as RLUSD, where issuers can block trust lines, while native XRP itself cannot be frozen on chain.
- Users are urged to update the DCENT app, move funds to a new wallet with a fresh recovery phrase, and monitor issuer and exchange responses.
Deep Dive
1. What Happened And How Big It Is
DCENT, a Korean wallet provider, issued an urgent alert after detecting abnormal transfers from its App Wallet, affecting XRP Ledger and several other networks.
XRPL intel reports roughly 6,160 potential victim addresses and about 9.3 million XRP stolen, with around 2 million XRP still in tracked wallets and 7 million sent to unidentified services, according to a detailed security update for app users and issuers here.
This is a wallet software compromise rather than a flaw in the XRP Ledger protocol, but the stolen funds are now circulating across XRPL-issued tokens and services.
2. Why Freeze Requests Matter
On XRP Ledger, issued tokens such as RLUSD and other IOUs are controlled by their issuers through trust lines, which can be frozen for specific addresses or globally.
Investigators have identified collection wallets holding RLUSD and multiple XRPL-issued tokens, and token issuers are being urged to freeze affected trust lines to prevent scammers from moving or redeeming those tokens.
Native XRP itself does not have an issuer and cannot be frozen at the protocol level, so freezes mainly constrain the movement and usability of issued tokens tied to the attacker, not the XRP that was taken.
3. What Users Should Do And Watch
DCENT instructs all App Wallet users to immediately update to version 10.0.0, run the in-app Check if action is needed, and follow its guidance before making further transactions.
The strongest mitigation is to move assets out of the compromised App Wallet into a new wallet created with a completely fresh recovery phrase, never reusing the old phrase, and to ignore any messages that ask for seed phrases or keys.
Users should watch for further updates from DCENT, announcements from major XRPL token issuers about freezes, and any exchange notices about blacklisted addresses or constrained deposits involving RLUSD or related tokens.
The exploit shows that compromised wallet software can put multi-chain holdings at risk, and issuer freezes can only partially limit damage, so keeping recovery phrases isolated and wallets up to date is critical.
Conclusion
The XRP-related exploit stems from a third-party wallet compromise, not a core ledger failure, but it has triggered wide-ranging freeze requests for XRPL-issued tokens tied to attacker wallets. For everyday users, the practical takeaway is to treat recovery phrases as highly sensitive, migrate off any compromised or outdated wallet software, and pay close attention to issuer and exchange actions that may affect how stolen or suspect funds can move.
CoinsKid.Com