XRP Phishing Ring Steals $8.5M from 71 Investors via Fake Flare Site
In brief
- Xora Finance, Xaman, and Doppler Finance issued phishing alerts targeting XRP holders
- Fake Flare Network staking site stole 3.4M XRP ($8.5M) from 71 investors
- Total losses from coordinated scam wave exceed $13.4 million
- Scammers clone trusted brands on X; users urged to verify account handles
Phishing Wave Hits XRP Ecosystem
Xora Finance issued an XRP phishing alert warning the community about fake sites cloning Flare Network, XORA, and other XRP brands. Joren Lundgren, Xora Finance founder, described the threat in stark terms: "There is a very sophisticated operation going on." The scammers target XRP holders with convincing replicas of trusted platforms, funneling victims toward fraudulent staking and token sites.
A particularly damaging attack involved a fake Flare Network staking site that robbed 71 investors of 3.4 million XRP worth approximately $8.5 million, according to Seoul police. The scale of losses is substantial. Estimated losses from the phishing scams exceed $13.4 million USD, making this one of the largest coordinated attacks on the XRP community in recent months.
Ecosystem Projects Sound the Alarm
Xaman wallet issued a security notice warning of an ongoing scam wave against XRP holders. The wallet reiterated longstanding safeguards: it will never DM or email users, and it will never issue a token or an airdrop. Support exists only inside the Xaman app, nowhere else.
Doppler Finance warned of accounts impersonating it on X and urged users to verify the account handle rather than just the display name. The project emphasized it will never request private keys, seed phrases, passwords, or funds via direct message.
Fake Ripple Announcement Circulates
Eagle-eyed XRP community members spotted a fake Ripple announcement on X claiming the company was launching XRP Holder Tiers and directing users to a fake website for an XRP badge. The scam was quickly identified as a phishing attempt. Users were warned not to click, connect wallets, or enter seed phrases on any unsolicited links, regardless of how official they appear.
The pattern is clear: scammers clone trusted brands, impersonate legitimate projects, and exploit the visual similarity of social media profiles to deceive holders. Verification of official account handles, not just display names, has become essential due diligence for XRP community members navigating this hostile environment.
