Home » Crypto News
XRPL users face coordinated scam surge, wallet founder says, as attackers deploy phishing, fake apps, and sign requests globally.
}
function loadTrinityPlayer(targetWrapper, theme,extras=””) {
cleanupPlayer(targetWrapper); // Always clean first ✅
targetWrapper.classList.add(‘played’);
// Create script
const scriptEl = document.createElement(“script”);
scriptEl.setAttribute(“fetchpriority”, “high”);
scriptEl.setAttribute(“charset”, “UTF-8”);
const scriptURL = new URL(`https://trinitymedia.ai/player/trinity/2900019254/?themeAppearance=${theme}${extras}`);
scriptURL.searchParams.set(“pageURL”, window.location.href);
scriptEl.src = scriptURL.toString();
// Insert player
const placeholder = targetWrapper.querySelector(“.add-before-this”);
placeholder.parentNode.insertBefore(scriptEl, placeholder.nextSibling);
}
function getTheme() {
return document.body.classList.contains(“dark”) ? “dark” : “light”;
}
// Initial Load for Desktop
if (window.innerWidth > 768) {
const desktopBtn = document.getElementById(“desktopPlayBtn”);
if (desktopBtn) {
desktopBtn.addEventListener(“click”, function () {
const desktopWrapper = document.querySelector(“.desktop-player-wrapper.trinity-player-iframe-wrapper”);
if (desktopWrapper) loadTrinityPlayer(desktopWrapper, getTheme(),’&autoplay=1′);
});
}
}
// Mobile Button Click
const mobileBtn = document.getElementById(“mobilePlayBtn”);
if (mobileBtn) {
mobileBtn.addEventListener(“click”, function () {
const mobileWrapper = document.querySelector(“.mobile-player-wrapper.trinity-player-iframe-wrapper”);
if (mobileWrapper) loadTrinityPlayer(mobileWrapper, getTheme(),’&autoplay=1′);
});
}
function reInitButton(container,html){
container.innerHTML = ” + html;
}
// Theme switcher
const destroyButton = document.getElementById(“checkbox”);
if (destroyButton) {
destroyButton.addEventListener(“click”, () => {
setTimeout(() => {
const theme = getTheme();
if (window.innerWidth > 768) {
const desktopWrapper = document.querySelector(“.desktop-player-wrapper.trinity-player-iframe-wrapper”);
if(desktopWrapper.classList.contains(‘played’)){
loadTrinityPlayer(desktopWrapper, theme,’&autoplay=1′);
}else{
reInitButton(desktopWrapper,’Listen‘)
const desktopBtn = document.getElementById(“desktopPlayBtn”);
if (desktopBtn) {
desktopBtn.addEventListener(“click”, function () {
const desktopWrapper = document.querySelector(“.desktop-player-wrapper.trinity-player-iframe-wrapper”);
if (desktopWrapper) loadTrinityPlayer(desktopWrapper,theme,’&autoplay=1’);
});
}
}
} else {
const mobileWrapper = document.querySelector(“.mobile-player-wrapper.trinity-player-iframe-wrapper”);
if(mobileWrapper.classList.contains(‘played’)){
loadTrinityPlayer(mobileWrapper, theme,’&autoplay=1′);
}else{
const mobileBtn = document.getElementById(“mobilePlayBtn”);
if (mobileBtn) {
mobileBtn.addEventListener(“click”, function () {
const mobileWrapper = document.querySelector(“.mobile-player-wrapper.trinity-player-iframe-wrapper”);
if (mobileWrapper) loadTrinityPlayer(mobileWrapper,theme,’&autoplay=1′);
});
}
}
}
}, 100);
});
}
})();
Summarize with AI
Summarize with AI
Xaman Wallet founder Wietse Wind has said that a “massive XRPL targeted scam effort” is underway, warning users about fake sign requests, phishing emails, and impersonation accounts.
His alert points to a rise in social engineering attacks aimed at crypto holders rather than flaws in the blockchain code.
A Multi-Pronged Attack on XRPL Users
Wind wrote on X on February 16 that he had spent the weekend adding new filters and alerts to Xaman Wallet after detecting coordinated attempts to trick users into signing malicious transactions.
He listed several methods seen in recent days, including scam NFTs that promise token swaps, fake desktop wallet apps, and direct messages posing as support staff. The official wallet account repeated the warning, telling users not to click links, respond to DMs, or connect wallets to unknown websites.
According to Wind, the attacks usually focus on manipulating users rather than breaching software, with the scammers expanding beyond social media and sending phishing emails even though Xaman does not store user email addresses, suggesting attackers are relying on leaked data from unrelated breaches.
The tricksters are also reportedly promoting fake “desktop wallets,” despite Xaman being a strictly mobile application. Some fraudulent projects are even promising free tokens in exchange for users’ secret keys.
Wind stressed that funds will stay safe if people avoid approving unknown transactions or sharing their keys.
You may also like:
Scams Moving Beyond DeFi Exploits
The XRPL scam wave reflects a troubling industry-wide trend, with a PeckShield report from earlier in the year revealing that crypto scams and hacks drained more than $4.04 billion in 2025.
Of that total, $1.37 billion came from scams alone, a 64% increase from 2024. The firm said attackers are shifting toward tailored phishing campaigns that target individuals with large holdings instead of relying only on technical exploits.
Furthermore, the PeckShield report also found that centralized platforms and companies accounted for about 75% of stolen funds last year, up from 46% in 2024.
These high-value thefts tied to deception extend beyond software wallets. On January 17, 2026, blockchain investigator ZachXBT reported that a victim lost about $282 million in Bitcoin (BTC) and Litecoin (LTC) through a hardware wallet scam. According to his findings, the attacker later moved the funds through THORChain and converted them to Monero (XMR).
Wind’s posts framed the latest campaign as a reminder that wallet security often depends on user decisions.
SECRET PARTNERSHIP BONUS for CryptoPotato readers: Use this link to register and unlock $1,500 in exclusive BingX Exchange rewards (limited time offer).
Source: https://cryptopotato.com/wallet-founder-warns-of-coordinated-scam-targeting-xrpl-users/
