I think my wallet was hacked or drained
If funds left your account without you, someone has your recovery phrase, secret numbers or private key, or has taken over the account's signing keys. Transactions cannot be reversed; what matters now is stopping further loss and understanding what happened.
How it shows up
- My USDC is gone and I didn't swap or send it
- My balance is much lower than it should be
- My funds are gone
- I'm being drained
- Someone moved my XRP
- I shared my phrase with support and now my balance is zero
- I clicked a prize or airdrop link
Needs a human from the team
Gather the details listed here and contact support from Settings, then Support.
Check it yourself
- Which applies: what is missing?
- If XRP, continue with step 2.
- If other tokens (USDC, USDT, BTC and so on), or XRP and other tokens, read "Other tokens than XRP" below, then contact support from Settings, then Support.
- Search your XRP address (in the app, tap Receive) on xrpscan.com and look at the XRP balance and the Owner Count.
- If it says "Account not found", read "This address never held funds" below.
- If the balance is more than the reserve (1 XRP, plus 0.2 XRP for each item in Owner Count), continue with step 3.
- If only the reserve is left, or less, contact support from Settings, then Support.
- Search your XRP address (in the app, tap Receive) on xrpscan.com and compare its XRP balance with how much XRP you had.
- If it says "Account not found", read "This address never held funds" below.
- If the balance is the same or more, read "Your XRP is all there" below.
- If the balance is lower, read "Less XRP than you had" below.
- If you do not know your XRP address (in the app, tap Receive) or how much XRP you had, read "Your XRP is still there" below.
- Look the address up on xrpscan.com and open the outgoing transactions: destination, time and amount. Ask the user whether they made them.
- On the account page check the Flags and the Regular Key. A RegularKey or SignerList the user did not set, or a disabled master key, means the attacker controls the account and it cannot be recovered even with the phrase.
- Ask, without judgement, whether the phrase, secret numbers or private key were typed anywhere other than the app, or shared with anyone claiming to be support.
- If the outgoing transactions are ones the user made and forgot, or a swap that is still settling, this is not a hack: redirect to the swap or activity pages.
Have this ready if you contact support
- Your XRP address
- The hashes of the transactions you did not make
- Where the recovery phrase or secret numbers may have been entered or shared
First, confirm it is a theft
Open Activity and compare with the account on an explorer such as xrpscan.com. Most "my funds are gone" reports turn out to be a hidden token, a swap that is still settling, or a payment the user made from another device. If there are outgoing payments you did not make, read on.
Your XRP is all there
The XRP Ledger shows at least as much XRP in this account as you had. Nothing has left it. If the app shows zero, or less than that, the app is not showing your balance: see Balances or prices are not loading. Your XRP is safe on the ledger the whole time.
Less XRP than you had
The XRP Ledger shows less XRP in this account than you had. Before anything else, check whether you sent it, swapped it, or used it on another device: open Activity, and the account's transactions on xrpscan.com. A swap moves XRP out of the account. If there are outgoing payments you did not make, contact support from Settings, then Support, and follow the steps in Do this now.
Your XRP is still there
The XRP Ledger still shows XRP in this account, so it has not been emptied. If the app shows zero, or less than the explorer, the app is not showing your balance: see Balances or prices are not loading. If a token is missing rather than XRP, it may be hidden from the list: see A token disappeared.
If the explorer also shows less than you expect, open the account's transactions on xrpscan.com. If there are outgoing payments you did not make, contact support from Settings, then Support, and follow the steps in Do this now.
This address never held funds
The XRP Ledger has no record of this address, so nothing was taken from it. Your funds are on a different address. If you have more than one wallet in the app, swipe through the wallets on the home screen and check each one. If you imported a wallet, the import may have produced a different account than the one you had: see I imported my wallet and the balance is zero.
Other tokens than XRP
First make sure the token is not just hidden: at the bottom of the balance list, tap Show filtered tokens. If it is there, see A token disappeared.
Tokens other than XRP are not on the XRP Ledger: they are held in your multichain account, so an XRP Ledger explorer cannot show them. If they are gone and you did not swap or send them yourself, treat it as a possible theft: follow the steps in Do this now and contact support from Settings, then Support.
Do this now
- Create a new wallet in the app, back up its phrase, and move whatever is left to it. Do not reuse the compromised wallet.
- If the compromised wallet was imported from another app or a browser extension, treat those as compromised too.
- Do not follow any link, install any "recovery" tool or pay anyone who promises to get the funds back. Recovery scams target victims within hours.
How it happens
- The recovery phrase, secret numbers or private key were typed into a website, a fake app or a form, or shared with someone posing as support.
- A "prize", "airdrop" or "verification" link asked to connect or confirm something.
- A phone or backup was accessible to someone else.
Nobody from XRP Mobile or Peersyst will ever ask for your phrase, and the app never sends it anywhere. The keys only exist on your phone.
Can the funds be recovered?
Sadly, no. Transactions on the XRP Ledger and on every other network are final. If the attacker also changed the account's signing keys (a regular key or a signer list, with the master key disabled), the account itself is lost even though the phrase still opens it in the app. Support can confirm exactly what happened from the explorer and help you secure a new wallet, but cannot reverse anything.
The app asks me to update
When a release fixes something that affects funds or security, older versions are asked to update before they continue. Updating never touches your wallet, your keys or your PIN.
Where are my XRPL tokens, IOUs, NFTs or MPTs?
This first version of XRP Mobile supports sending and receiving XRP on the XRP Ledger, plus swaps and multichain assets through NEAR Intents. Tokens issued on the XRP Ledger itself (IOUs and trust lines, NFTs, MPTs) are still in your account on the ledger, but the app does not show or move them yet.