XRP security alert prompts token freeze calls

TLDR

A security breach at the DCENT XRP App Wallet has triggered community calls for freezing affected XRPL tokens to contain millions of dollars in stolen assets.

1. DCENT reported abnormal transfers from its App Wallet, with onchain intel flagging about 9.3 million XRP stolen and thousands of victim addresses.
2. XRPL analysts are urging issuers, especially RLUSD, to freeze compromised trust lines so thieves cannot move affected tokens, while native XRP itself cannot be frozen.
3. For most XRP holders, the risk is wallet related rather than a core XRPL flaw, so the priority is securing recovery phrases, moving funds, and watching DCENTs ongoing updates.

Deep Dive

1. DCENT Wallet Incident

DCENT, a Korean Web3 wallet provider, issued an urgent security alert after detecting abnormal asset transfers from its software-only App Wallet, including on the XRP Ledger. The alert instructs users to update the app to version 10.0.0, run the internal check tool, and follow guidance in the app for remediation, as described in the DCENT security notice for XRP holders using the App Wallet.

XRPL-focused intel accounts report around 6,160 potential victim addresses and roughly 9.3 million XRP stolen, with about 2 million XRP still sitting in identified collector wallets and 7 million sent to services that have not yet been fully traced. The issue appears tied to App Wallet usage and recovery phrases entered there, not to DCENT hardware wallets or the XRPL protocol itself.

2. Why Token Freezes Are Being Urged

On XRPL, issuers of tokens such as stablecoins can freeze individual trust lines or, in some cases, an entire token. This stops movement of that issued asset for specific accounts but does not affect the native XRP coin.

Community alerts highlight two collector wallets, one holding RLUSD and another holding multiple XRPL-issued tokens, and urge issuers to freeze affected trust lines to prevent scammers from cashing out or swapping those tokens further. Recent XRPL upgrades even optimize checks for asset freeze status, reflecting that freeze controls are part of the design for handling exactly these kinds of incidents.

3. Practical Steps And What To Watch

For users who ever entered a recovery phrase into the DCENT App Wallet, the recommended actions are clear: update the app, stop using the compromised wallet, generate a new recovery phrase in a clean environment, and move assets to a fresh wallet without reusing the old phrase. DCENT also stresses that it will never ask for recovery phrases, private keys, or direct transfers via unofficial channels, so phishing risk is high around this event.

Looking ahead, key signals to monitor are: DCENTs ongoing investigation updates; whether RLUSD and other issuers rapidly freeze known compromised trust lines and possibly reissue tokens to victims; and any broader XRPL ecosystem changes to wallet security practices and monitoring tools.

Conclusion

The XRP security alert centers on DCENTs App Wallet, where compromised recovery phrases and abnormal transfers allowed attackers to drain millions in XRP and XRPL-issued tokens. Community calls for token freezes are a targeted attempt to contain damage in those issued assets, not a sign that XRP itself can be seized. The main takeaway for XRP users is to treat this as a serious wallet-level incident, harden key management, and watch how quickly issuers and infrastructure providers respond to close the gap between fast-moving exploits and mitigation tools.