XRP Security Alert: Web3 App Wallet Users Urged to Act Now

Security warning hits XRP community as Web3 wallet users face urgent action.

Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.

XRP holders using the DCENT App Wallet are urged to take immediate security precautions according to a recent X update by the Korean wallet provider.

As reported, DCENT detected abnormal transfers involving its software-based App Wallet and launched an investigation that identified potential impact across several networks, including XRP Ledger (XRPL).

In a post, DCENT urges App Wallet (software wallet) users to take action now. They are urged to update the DCENT app to v10.0.0 first and then run “Check if action is needed” and follow the result shown in the app.

DCENT App Wallet (software wallet) users: please take action now.

Update the app, check whether action is required, and move your assets if needed.

Please share this notice with anyone who may still be using the App Wallet. https://t.co/DScmkYb6qO

Specifically, this applies to users who use the DCENT App Wallet (software wallet) or have ever entered or restored their hardware wallet recovery phrase in the App Wallet.

DCENT noted that the most important step now is to prevent further damage by moving assets out of the DCENT App Wallet (software wallet) to a secure wallet.

Users should not make any transactions through the App Wallet before updating. They should move their assets to a wallet created with a new recovery phrase and never reuse the old recovery phrase.

In the wake of the incident, DCENT continues to send out scam warnings, saying it has separate support accounts on X and no official Telegram or Discord support channels. Also, it will never request a recovery phrase, wallet key, or PIN, or instruct users through a direct message to transfer funds.

In an update shortly after the unauthorized transactions were flagged, DCENT highlighted user addresses that might be affected by the incident.

This includes addresses whose recovery phrase was at some point entered into the DCENT App Wallet; addresses that have a history of sending (signing), including token and NFT transfers, token approvals, and dApp transactions; the signing took place on an app version below 8.1.0 (released 2025-11-05); and the address is on Bitcoin, Ethereum, XRP Ledger, TRON, an EVM-based network, or another potentially affected chain.

A recent update by the XRPL intel X account identifies 6,160 potential victim addresses and 9.3 million XRP stolen.

The tracked funds are mixed with XRP received from other sources: 2 million XRP are held in tracked wallets, while 7 million XRP were sent to unidentified services.

Two wallets have been identified where issued tokens stolen from D’CENT App users were collected: one holds RLUSD, and another holds multiple XRPL-issued tokens.

Token issuers have been urged to freeze the affected trust lines to prevent the scammers from moving these assets, which will apply to RLUSD in this case.