Fake Xaman NFT Scam Drains XRP Wallets: How It Works and How to Stay Safe

The Malicious Transaction Users Are Tricked Into Signing

1. An unsolicited NFT is deposited into the victim's wallet, often with a title or description suggesting a prize, giveaway, or "verification" step .
2. The NFT contains a hidden Buy Offer. When the user signs or accepts the offer—mistaking it for a reward claim or verification—the transaction authorizes the scammer to drain XRP and other assets from the wallet .
3. Another variant involves fake payment requests disguised as "safe XRPL verification" messages. Victims who approve the request lose their funds immediately .

Reported Financial Losses

• A victim lost 14,646 XRP (approximately $16,800) in June 2026 after approving a fraudulent payment request disguised as a wallet verification prompt .
• Another holder lost 6,000 XRP after accepting a fake NFT buy-offer, as reported in May 2026 .
• Ripple CTO David Schwartz has emphasized that because XRP has no central issuer, stolen tokens cannot be frozen, revoked, or recovered — losses are permanent .

Broader Context: "Huge Escalation" in XRP Scams

The NFT phishing campaign is part of a much broader wave of fraud targeting the XRP community.

David Schwartz's Warning (May 14, 2026)

Ripple CTO David Schwartz posted an urgent alert on X (Twitter), stating there has been "a huge escalation lately in airdrop and giveaway scams targeting XRPL users." He warned that nearly all such promotions seen on social media are fraudulent, and that anyone impersonating him on Instagram, Telegram, or elsewhere is a scammer .

XRPL Foundation Warning

The XRP Ledger Foundation issued a parallel alert, confirming that scams targeting the XRP community "had increased sharply" and urging users to avoid airdrops, giveaways, and fake customer support offers on X .

Other Scam Tactics in the Same Wave

• Mass bot campaigns impersonating the XRPL Foundation and Xaman wallet to push fake "RLUSD Season 1" airdrops .
• Deepfake AI videos impersonating Ripple executives to promote fake giveaways .
• Phishing websites mimicking legitimate XRPL wallets, prompting users to connect their wallets or approve fraudulent transactions .
• Fake Xaman desktop apps and over 20 fake social media profiles created daily .

Recommended Protective Measures

Based on warnings from David Schwartz, Wietse Wind (Xaman founder), and the XRPL Foundation:

• Never sign or accept unsolicited NFT offers. Immediately cancel any unknown offers in your wallet .
• Ignore all airdrop, giveaway, and "reward" promotions on social media — they are virtually always scams .
• Do not connect your wallet to unfamiliar websites claiming to offer free XRP or NFT rewards .
• Never share your wallet seed phrase or private keys with anyone .
• Verify all communications: Ripple and the XRPL Foundation never ask users to send XRP or share wallet details .
• Use wallet tools like Bithomp and Xaman to review and cancel pending offers — but recognize that once funds are stolen, recovery is rarely possible .
• Be wary of impersonation accounts on X, Instagram, and Telegram. Schwartz himself warns that anyone claiming to be him on these platforms is a scammer .