New Scam Method Involving XRP

Holders of XRP have been warned about a new phishing campaign utilizing the escrow mechanism in the XRP Ledger. The issue is that a user may see an unexpected transaction in their wallet that looks like a deposit or locked funds, even though they never initiated it themselves.

🚨Attention XRPL Community 🚨

Today a community member reached out about strange transactions in their @XamanWallet and asked if I had any. I looked in my wallet and I found two escrow transactions... one for creation & another to cancel.

Utilizing the support xAPP within the... pic.twitter.com/35PtPw6WDn
--- Stone (@Stone_XRPL) August 15, 2026

Xaman Wallet confirmed that this is a known scam method. The criminals' goal is not to send a transaction but to entice the user to click a link found in the transaction details and then sign a malicious transaction.

This is designed to prompt user action

The issue was brought to light after Web3 consultant Stone noticed two strange operations in his Xaman Wallet. One created an escrow, and the other canceled it. Instead of interacting with the transactions, he contacted Xaman's official support through the support xAPP. According to the team's response, scammers are sending unwanted escrow transactions to random XRP Ledger addresses. These transactions may appear to contain large amounts of tokens, including assets masquerading as USDT0 or other fake coins. However, the most critical element of the attack is the links embedded in the transaction data or memo field. The user may be redirected to a site claiming to allow them to "claim," "unlock," or "release" funds. It is at this stage that the real threat begins. But that's not all.

Receiving a transaction does not mean a breach

Xaman emphasized a very important point: the mere appearance of a suspicious transaction in a wallet does not mean that funds have been compromised. Scammers do not gain access to XRP simply because they sent something to a given address. Theft can only occur if the user connects their wallet to a fake site and approves a transaction prepared by the criminals. A malicious transaction can grant attackers permissions to seize the assets in the account. Therefore, Xaman advises not to sign any transactions that the user did not consciously initiate themselves.

Why can't such transactions be blocked?

Xaman also explained that users do not have the ability to completely block this type of activity. The XRP Ledger is a public and decentralized network. Unfortunately, an active address can send a transaction to another address without the recipient's prior consent. Xaman compared this to receiving junk mail -- the recipient does not control who can send them something. Such a transaction also cannot be removed from the public blockchain history. At the same time, the recipient does not incur network costs associated with the suspicious operation. The fees are covered by the sender.

How to protect XRP from new phishing attempts?

Xaman reported that the identified scammer's account has been added to the blacklist database. However, the most important factor remains user behavior. Unexpected escrows should simply be ignored, links in the memo or transaction details should not be clicked, and wallets should not be connected to unknown sites. In case of doubt, the best solution is to contact Xaman's official support rather than attempting to "claim" the alleged funds on one's own. The new campaign shows that phishing on the XRP Ledger increasingly does not rely on simple impersonation of an airdrop or giveaway. Scammers are trying to exploit normal network functions and create the impression that the user already possesses some funds. The wallet itself remains safe as long as the owner does not sign a malicious transaction. Therefore, the awareness and creativity of criminals are growing (which does not surprise me). More about XRP is discussed below:

The Ultimate Test for XRP. Everyone is betting on growth, but disaster looms.

XRP is experiencing a massive increase in network activity. Will Ripple's price rebound?