XRP Holders: Xaman Scams Are Back, and the Fake-Wallet Wave Hits Now

Why the 20+ Daily Fake Accounts Matter More Now

This is no longer just a "don't click random links" warning. Xaman founder Wietse Wind said scammers are creating 20+ scam X accounts daily and more than 10 fake domains daily impersonating Xaman, promoting a fake desktop wallet and airdrop that do not exist. When impersonation scales like that, the risk stops being background noise and starts becoming a real threat to user capital.

The core debate is about exposure. Some see these scams as isolated social-engineering incidents that do not change XRP's broader setup. But if fake accounts and domains keep refreshing faster than they can be taken down, the attack surface is large enough to matter. For holders, that matters because losses are already happening, not just theory.

The scale of the threat is easier to appreciate when you look at recent phishing campaigns in the XRPL ecosystem, where fake announcement funnels have pushed users toward fraudulent sites and wallet connections. That is why this should be treated as a practical risk to balances, not just a reputational nuisance.

How the Scams Are Working Now

The trap is no longer just about landing on a fake webpage. Scammers are increasingly pushing direct wallet interactions that require a click, a review, or a connection.

NFT offers are the current bait

One active pattern starts with fake NFTs with an offer to trade. Scammers send an NFT and then try to open an offer in the user's wallet, hoping they engage. Xaman's warning is straightforward: the team is not sending passes or NFTs, and users should not engage with or accept unsolicited offers. Instead, they should cancel them.

That matters because the danger often increases the moment a user interacts with the offer inside the wallet. Curiosity can quickly turn into a signed transaction.

Fake holder tiers turn status into a connection prompt

Another active pattern is the fake announcement funnel. The recent "XRP Holder Tiers" scam claimed Ripple was introducing tiers and badges, then directed users to a fraudulent site. The lure is familiar: people are offered status, perks, or a badge their balance supposedly unlocks.

Ripple and XRPL Foundation voices made clear that those badges do not exist and that no holder needs to claim them through a third-party site or link. That is social engineering, not a protocol issue, but the capital risk is still real because the funnel wants a wallet connection or signature.

Do not confuse scam flow with real product activity

Scam activity is being layered on top of normal Xaman usage, not caused by it. For example, Xaman Swap has reported ~1 in 5 swaps uses a custom route, a genuine product detail aimed at improving pricing across XRPL assets. That has nothing to do with beta passes, NFT offers, or holder-tier badges.

A practical rule: if it arrives as an offer or a "claim your tier" link outside official channels, treat it as hostile until you can verify the source.

What to Watch Next: Verification Matters More Than Trust

The next move for users is not valuation; it is verification. With scam accounts and fake domains appearing daily, the edge goes to anyone who treats unsolicited wallet prompts as risky until the source checks out. Xaman's rule is direct: No DMs. No links. No emails. No exceptions. Support is only available inside the app, and that remains the cleanest filter while the attack pipeline is still active.

Signs the wave is easing

The pressure should ease if official accounts stop repeating that there is no desktop wallet and no airdrop, and if "XRP Holder Tiers" scam prompts fade from user reports. That would suggest attackers are losing some of their current hooks.

Signs the wave is still live

If users are still being pushed into fake NFTs with an offer to trade, wallet connections, and transaction reviews from unverified sources, the funnel is still active. Until that changes, preservation should come first: verify the source before you sign anything.

XRP Holders Should Treat Unsolicited Wallet Prompts as Hostile

With new scam accounts and fake domains appearing daily, verification matters more than trust. The current threat mixes fake accounts, fraudulent sites, unsolicited wallet offers, and fake announcement funnels. That is not a case for panic, but it is a reason to stay cautious. One careless interaction can undo a lot of holding.