Safety
Issuer verification, phishing defense, signing review, custody risk, and what to do when something goes wrong.
Protect signing authority
The account is only as safe as the keys and signing methods controlling it.
- Keep the seed offline and private.
- Use separate accounts for daily activity and serious holdings.
- Review regular-key and signer-list settings.
- Assume a leaked seed is permanently compromised.
Verify the issuer every time
Tickers and logos are easy to copy. Issuer identity separates assets.
Official source
Get the issuer from the project’s official site.
Exact match
Compare the full address.
Ledger behavior
Inspect supply, holders, markets, and issuer settings.
Phishing and fake connection flows
Scammers can trick you into authorizing the transaction yourself.
Read the transaction, not the promise
The transaction fields control what happens. Marketing text doesn’t.
Type
What transaction is this?
Account
Which account is signing?
Destination
Who receives value or authority?
Amount
How much and which asset?
Settings
Are flags or permissions changing?
Fee
Is the fee abnormal?
Exchange and platform risk
Custody risk exists even when XRPL itself is working perfectly.
Withdrawal freeze
The platform can pause access.
Insolvency
An internal balance may not equal fully backed assets.
Account closure
Terms or compliance can block access.
What to do after compromise
Speed matters, but panic creates more damage.
- Stop signing from the compromised setup.
- Move remaining assets with a clean device and clean account if it’s still safe.
- Rotate regular keys or signer lists when appropriate.
- Document transaction hashes and affected accounts.
- Contact exchanges if stolen funds reach custodial platforms.
Did it click?
Answer these without guessing.
What should you trust more?
Does changing an app password fix a leaked seed?
What identifies an issued asset?
Keep moving
Open the next application and keep building the full picture.