XRP has spent years in the headlines, which makes it easy to forget the duller question underneath all of it: who actually controls your coins? Almost every stolen-crypto story follows the same script, and it rarely involves anyone breaking a blockchain. Someone handed over a recovery phrase. Someone reused a password. Someone clicked a link at eleven at night and typed their login into a page that looked right. In the UK, a crypto transfer is final. There is no chargeback, no manager to escalate to, no number to ring. The ten steps below take an afternoon and close off most of the ways people lose XRP.
The ten-point checklist, at a glance
- Use an authenticator app, not SMS, for every exchange and wallet that offers two-factor authentication.
- Move long-term holdings into a hardware wallet that you own and control.
- Write your recovery phrase down on paper or steel the day the wallet arrives, before you send anything to it.
- Keep a second backup in a different building — a relative's safe, a bank box, a solicitor's strongroom.
- Give exchanges a dedicated email address and a long, unique password from a password manager.
- Bookmark the sites you actually use and log in only through those bookmarks.
- Switch on withdrawal address whitelisting and any cooling-off hold your exchange offers.
- Send a small test amount first and confirm it lands before moving the rest.
- Check the destination tag on every XRP deposit to a centralised exchange.
- Review your accounts monthly: active sessions, API keys, trusted devices, app updates.
Two-factor authentication: the cheapest upgrade you can make
A code sent by text message is better than nothing, but not by much. SIM-swap attacks, where someone persuades your mobile network to move your number onto their SIM, have been used repeatedly to empty crypto accounts in the UK and beyond. Once your number is theirs, every SMS code arrives on their phone.
What to use instead
Use a time-based authenticator app on every account that holds value, or a hardware security key if the platform supports one. Register a second device so a lost phone does not lock you out, and print the backup codes rather than leaving them in a notes app. Your email address deserves the same treatment, because it is the master key to every password reset. If a provider offers passkeys, take them.
Hardware wallets and the XRP Ledger
A hardware wallet keeps your private keys on a device that never touches the internet. You can hold XRP in self-custody on the XRP Ledger with a reputable hardware wallet that supports the network, or pair one with a software wallet for everyday signing. The brand matters less than the discipline around it: buy direct from the manufacturer rather than a marketplace seller, check that the packaging is sealed, and set your own PIN.
The rule with no exceptions
No legitimate wallet, exchange or support agent will ever ask for your recovery phrase, and none will contact you first to "validate" your wallet. If those words come up, you are being robbed, however professional the website looks. If a new device arrives with a phrase already written on a card, send it back; that phrase belongs to someone else.
Backups that survive real life
Your recovery phrase is your account. Paper burns, floods, and disappears during a house clearance, so treat the words as something that needs a proper home. Engraved steel plates survive fire and water for less than the cost of a decent dinner. Never photograph the phrase, never type it into a computer, and never store it in cloud notes or a password manager's text field.
Split the risk. Keep one copy where you live and another somewhere you trust, and think about who would find it if you were suddenly unable to move funds. The XRP Ledger does support more advanced setups, such as a regular key or multi-signing, so that no single key can move money alone. That adds complexity and new ways to lock yourself out, and for most holders two offline backups in separate locations is the sensible ceiling.
Phishing, fake airdrops and "support" messages
Most XRP theft starts with a message. The formats change constantly: an airdrop that asks you to "activate" a wallet, a giveaway promising to double whatever you send, a convincing email claiming your exchange account has been restricted, a sponsored search result pointing at a copy of the real login page. Others arrive as direct messages on X or Telegram from an account using a familiar name and photo.
- Reach login pages through your own bookmarks. Not through email links, search ads or DMs.
- Read the domain, not the design. A page at ripple-claim.example has nothing to do with the real thing, whatever the logo suggests.
- Check the first and last characters of any address you paste, then glance at the middle. Malware that swaps clipboard contents has cost people a great deal.
- Treat urgency as a warning sign. Genuine platforms do not need an answer in the next ten minutes.
- Never install remote-access software because a caller asked you to.
Everyday habits on exchanges
Exchanges are for trading, not for storage. Keep only the balance you need there, and let the rest sit in self-custody. Enable withdrawal whitelisting, use any cooling-off period offered on newly added addresses, and turn on login and withdrawal alerts by email. Review API keys and delete the ones you no longer use: an old key with trading or withdrawal permissions can be used without your password. Change your password after any data breach at any service, even an unrelated one, because credential lists get reused. Keep apps and your operating system updated, use mobile data rather than open Wi-Fi when you are logging in, and remember that some exchanges rotate deposit addresses, so verify the address each time you send.
If something goes wrong
Work fast. Create a fresh wallet with a new recovery phrase on a clean device and move anything still under your control. Then change the password and revoke active sessions on every exchange account, starting with your email. Contact the exchange straight away: nobody can reverse an on-chain transfer, but a deposit that reaches them in time can sometimes be frozen. Report the loss to Action Fraud in England, Wales and Northern Ireland, or to Police Scotland, and keep screenshots, transaction hashes and wallet addresses as evidence. If fiat money moved through your bank, tell them as well.
None of this is glamorous, and none of it is difficult. Set aside an afternoon, work through the checklist, then diarise a monthly review so it does not drift. For anything involving tax on a loss or a disposal, speak to an accountant who deals with crypto; what is above is general security guidance, not financial advice.
Photo: succo / Pixabay
