TLDR
A security incident at DCENTs XRP-compatible wallet has led to millions of XRP being stolen and renewed debate over when token issuers should freeze compromised funds.
- DCENTs App Wallet suffered a breach affecting multiple chains, with analysts estimating about 9.3 million XRP stolen from more than 6,000 addresses.
- On XRP Ledger, issuer-backed tokens like RLUSD can be frozen via trust lines, and community analysts are urging issuers to use this tool against the stolen balances.
- The episode highlights growing expectations that issuers and wallets can intervene after hacks, and shows why users need hardened key storage and careful choice of custodial tools.
Deep Dive
1. DCENT Wallet Breach Details
Korean wallet provider DCENT issued an urgent alert after detecting abnormal transfers from its DCENT App Wallet, a software wallet that supports XRP Ledger and several other networks.
According to a detailed XRP security alert for DCENT wallet users, on-chain analysts identified about 6,160 potentially affected addresses and roughly 9.3 million XRP stolen, with around 2 million XRP still sitting in tracked wallets and the rest routed through unidentified services.
DCENT urges anyone who used the App Wallet, or entered a hardware wallet recovery phrase into it, to update to version 10.0.0, check if action is needed, and move assets to a new wallet created with a fresh recovery phrase, never reusing the old one.
2. How Issuer Freezes Work On XRPL
The calls for issuer freezes target XRPL issued tokens, not XRP itself. On XRP Ledger, assets like Ripple USD (RLUSD) are issued via trust lines, where the issuer can flag specific trust lines as frozen to block further transfers from compromised addresses.
In this case, XRPL intelligence accounts report that two collector wallets hold stolen tokens, including RLUSD and other issued assets, and explicitly urge issuers to freeze the affected trust lines to stop scammers from moving those balances further. XRP, as the native coin, does not have an issuer-level freeze switch, so stolen XRP itself cannot be frozen on-chain.
This design mirrors a broader regulatory trend. Under a Treasury rule implementing the GENIUS Act, permitted dollar stablecoin issuers must already be able to block and freeze transactions, and Tether recently froze 344 million USDT on Tron in a single action, underscoring how issuer controls are becoming standard for fiat-like tokens.
Tokens that behave most like bank money often come with bank-like powers, including freezes, which can help claw back hacked funds but reduce pure censorship resistance.
3. What To Watch And How Users Can React
Key near-term signals include DCENTs forensic findings, any published list of affected addresses, and announcements from XRPL token issuers such as RLUSDs issuer about whether they are freezing stolen balances.
For users, the practical takeaway is to treat software wallets as high-risk if they ever handle recovery phrases. Moving significant holdings to hardware wallets and never reusing a compromised seed sharply reduces exposure to wallet-level exploits. At the protocol level, XRPL itself remains operational, but reliance on issuer tokens and third-party wallets introduces additional trust layers that need ongoing scrutiny.
Monitor official DCENT and issuer updates, assume any seed ever entered into the compromised app is unsafe, and factor issuer-level controls into how you use stablecoins and other XRPL-issued assets.
Conclusion
The DCENT breach shows that most of the risk sat above XRP Ledgers core, in wallet software and issuer-managed tokens, yet the fallout still lands on XRP users and XRPL projects. As issuers gain stronger freeze tools and regulators push for them, the trade-off between safety and censorship resistance becomes a central design choice that users, wallet providers, and token issuers all need to understand and monitor.
CoinsKid.Com