XRP holders using the DCENT App Wallet are urged to take immediate security precautions according to a recent X update by the Korean wallet provider.
As reported, DCENT detected abnormal transfers involving its software-based App Wallet and launched an investigation that identified potential impact across several networks, including XRP Ledger (XRPL).
In a post, DCENT urges App Wallet (software wallet) users to take action now. They are urged to update the DCENT app to v10.0.0 first and then run "Check if action is needed" and follow the result shown in the app.
Specifically, this applies to users who use the DCENT App Wallet (software wallet) or have ever entered or restored their hardware wallet recovery phrase in the App Wallet.
DCENT noted that the most important step now is to prevent further damage by moving assets out of the DCENT App Wallet (software wallet) to a secure wallet.
Users should not make any transactions through the App Wallet before updating. They should move their assets to a wallet created with a new recovery phrase and never reuse the old recovery phrase.
In the wake of the incident, DCENT continues to send out scam warnings, saying it has separate support accounts on X and no official Telegram or Discord support channels. Also, it will never request a recovery phrase, wallet key, or PIN, or instruct users through a direct message to transfer funds.
9.3 million XRP stolen
In an update shortly after the unauthorized transactions were flagged, DCENT highlighted user addresses that might be affected by the incident.
This includes addresses whose recovery phrase was at some point entered into the DCENT App Wallet; addresses that have a history of sending (signing), including token and NFT transfers, token approvals, and dApp transactions; the signing took place on an app version below 8.1.0 (released 2025-11-05); and the address is on Bitcoin, Ethereum, XRP Ledger, TRON, an EVM-based network, or another potentially affected chain.
A recent update by the XRPL intel X account identifies 6,160 potential victim addresses and 9.3 million XRP stolen.
The tracked funds are mixed with XRP received from other sources: 2 million XRP are held in tracked wallets, while 7 million XRP were sent to unidentified services.
Two wallets have been identified where issued tokens stolen from D'CENT App users were collected: one holds RLUSD, and another holds multiple XRPL-issued tokens.
Token issuers have been urged to freeze the affected trust lines to prevent the scammers from moving these assets, which will apply to RLUSD in this case.
