DCENT Issues Urgent Security Warning for XRP Users

South Korean crypto wallet provider DCENT has issued an urgent security warning for users of its software-based App Wallet. The company stated that it has detected unusual transfers associated with unauthorized transactions and that the investigation poses a risk that could affect multiple networks, including the XRP Ledger.

Update and Call to Move Assets

DCENT has requested App Wallet users to first update the application to version 10.0.0 and then run the "check if a transaction is needed" step within the app. The warning applies to those using the software wallet and anyone who has entered or restored a hardware wallet recovery phrase into the App Wallet at any stage.

The company indicated that the most critical step at this stage is to move assets out of the App Wallet to a secure wallet to prevent further damage. Users are advised not to conduct transactions through the app until the update is complete, to transfer their assets to another wallet created with a new recovery phrase, and not to reuse the old recovery phrase.

DCENT urged users to first update the app to version 10.0.0 and then follow the necessary steps from the control screen within the app.

Potentially Affected Addresses

DCENT also shared criteria regarding addresses that may have been affected after the incident. Accordingly, addresses that have previously entered a recovery phrase into the App Wallet, those with signature history for token and NFT transfers, token approvals, or decentralized application transactions, as well as users who signed in an application older than version 8.1.0 are considered at risk. The company reported that this scope includes Bitcoin, Ethereum, XRP Ledger, TRON, EVM-based networks, and other chains that are thought to be potentially affected.

The XRPL intel account, which monitors the XRPL ecosystem, identified 6,160 potential victim addresses and a loss of 9.3 million XRP. It was reported that a portion of the tracked funds was mixed with XRP from other sources, with 2 million XRP held in the monitored wallets, while approximately 7 million XRP was sent to unidentified services.

Call to Freeze Issuer Tokens

The tracked findings also revealed two wallets where issuer tokens stolen from DCENT App users were aggregated. One of these wallets held RLUSD, while the other contained multiple tokens issued on the XRPL. A call was made to the relevant token issuers to freeze affected trust line connections to prevent scammers from moving these assets. It was noted that this step would also apply to RLUSD.

In such incidents, careful monitoring of on-chain movements and transaction signatures is emphasized, while similarly, it is important to track investor behaviors in the meme token market in real-time. A trend in the meme token market can turn into millions of dollars in interest within days. According to data shared by Fomo, a transaction that increased a $99 initial amount to approximately $370,000 in Niu Lai is one of the striking examples of this volatility. In this market, it is also noteworthy to track not only prices but also when and which tokens investors are trading. Fomo App brings together token discovery and trading on the same platform with social feeds, investor rankings, and transaction notifications. Discover Fomo App to follow the meme token world along with investor movements.

Warning Against Fake Support Accounts

Following the incident, DCENT also issued consecutive warnings against fake support attempts. The company stated that it uses separate support accounts on X and does not have an official Telegram or Discord support channel. It also emphasized that under no circumstances will it request recovery phrases, wallet keys, or PINs, nor will it direct money transfer requests via direct messages.

The company stressed that it will never ask for recovery phrases, private keys, or PIN information and will not give instructions for fund transfers via direct messages.