David Schwartz Warns XRP Holders of Scam Link Asking for 12 or 24-Word Phrases

Schwartz Trips the Bait in Notification History

Ripple CTO Emeritus David Schwartz has exposed a phishing attempt that impersonated the SecuX hardware wallet app on his Android device and pushed a link to a page demanding a 12- or 24-word recovery phrase. Schwartz, Ripple's longtime chief cryptographer and one of the most closely watched security voices around the XRP Ledger, wrote that the notification reached him as an apparent message from SecuX. He tapped it out of curiosity, the app opened normally and nothing seemed unusual, he said, until he opened his notification history. There the full message surfaced: it claimed funds were at risk, that a critical vulnerability had been detected in the SecuX wallet and that immediate verification was required. The link inside it, Schwartz stated, went to a scam page asking the user to enter 12 or 24 words. Those words form the seed phrase, the single most sensitive credential a crypto wallet holder owns, since anyone who obtains it can restore the wallet on another device and take control of its funds. His post about the fake notification carries the rule he attached to the episode in three words: “Never do that.” An observer who followed the exchange urged people not to tap such notifications at all, and Schwartz answered that curiosity had won in his case, and that the danger only became clear once he inspected the notification log. Push messages like this inherit the trust of the app they appear to come from, which is what made the disguise effective enough to reach a veteran of the industry. The warning lands with force among XRP investors, for whom devices of this type are a common storage choice for XRP, and the attempt targeted credentials rather than anything connected to the XRP price.

SecuX Emergency Maintenance on October 16

The warning surfaced hours after SecuX, the vendor behind the app in question, disclosed emergency maintenance. On October 16 the company said its wallet app was undergoing a major system upgrade and urgent maintenance intended to strengthen security and stability, without describing the issue that forced the intervention. A follow-up service update confirmed that the application had returned to normal operation. With that confirmation the vendor repeated a standing rule: it will never ask for a 24-word recovery phrase, users should avoid suspicious or unverified links, and messages impersonating SecuX Support deserve suspicion. Schwartz's post carried an October 16 date as well. What remains unresolved is the origin of the notification itself. He did not establish whether the message came from the app, from a third-party notification service or from some other channel, and nothing published so far independently shows that SecuX's software or infrastructure was breached. The company's maintenance notice also stops short of explaining what went wrong. The available record, in other words, confirms the scam attempt and the maintenance, but not yet any compromise. That gap matters for XRP holders who rely on cold wallet storage for long-term positions: an unexplained maintenance window on a wallet app, followed by a fake notification impersonating that same app, is precisely the pattern phishing crews look to exploit. Mobile push notifications have become a persistent delivery channel for crypto scams because they appear on the lock screen next to genuine alerts, and a single tap is often all it takes to reach the fraudulent page. Verification, not instinct, is what separates the two: checking the sender, the link and the request before entering anything.

A Recovery Phrase Cannot Be Rotated

Our reading of the two statements is that the cheapest defense here is also the strongest. Schwartz's own record of the incident shows the scam's entire payload was a request for words: no signature prompt, no transaction and no private key exposure. A recovery phrase cannot be changed once an attacker has seen it, so a holder who types it in must move every asset to a freshly generated wallet, the process laid out in our guide to crypto wallet recovery. Until SecuX explains what triggered the October 16 maintenance, the working assumption for anyone tracking XRP coverage should be that a notification, banner or email asking for recovery words is hostile, whatever app it claims to come from.