Community Trust ScoreVerified
Scammers are going after XRP holders hard right now. They’re building fake wallet addresses and dummy tokens that borrow the names of real financial institutions — and the timing is deliberate.
Why It Matters
This matters because scams that mimic familiar financial brands can erode trust at the exact point where retail users are most likely to make fast, irreversible wallet decisions. For XRP holders, the takeaway is that branding alone is not a signal of legitimacy on-chain, and heightened attention to wallet verification and token provenance is essential as fraudulent schemes continue to evolve.
An XRPL Foundation contributor posting under the handle @Vet_X0 flagged the scheme this week. The warning centers on vanity XRP Ledger addresses — polished, bank-sounding wallet IDs like “rBankxxx” — paired with fake tokens carrying similar branding, something like “$BANKxxx.” The addresses are designed to look connected to institutions that have actually made news lately. Cross River Bank’s tests of the RLUSD stablecoin and Evernorth’s 473 million XRP fund deployment through major exchanges are the two legitimate developments being copied. Scammers spotted those announcements and moved fast, spinning up lookalike addresses and issuing tokens that appear, at a glance, to belong to the same story. They don’t.
Anyone can issue a coin on XRPL. Full stop.
How the Fake Token Playbook Works
The mechanics aren’t technically complicated, and that’s kind of the point. When a bank or company announces something real on the XRP Ledger, scammers can generate a similar-looking address within hours. Pair that with a token name that echoes the announcement, and you’ve got something that looks credible to someone who isn’t looking closely.
From there, users get directed to phishing sites. The pitch varies — verify your wallet, swap real XRP for the bank-linked token, claim an airdrop — but the destination is the same: gone. A blockchain explorer might show the token sitting right there in a listing. That listing proves nothing. It confirms only that the asset exists on the ledger technically. The explorer doesn’t know whether a bank created it, approved it, or has ever heard of it. Visibility on-chain is not authentication. Those are two very different things, and scammers are counting on people confusing them.
Bank branding does not establish institutional backing.
The social engineering angle here is worth sitting with. Earlier XRP-related incidents leaned on technical flaws — a summer botnet that drained wallets, fake NFTs, a September hack of the Bitget exchange involving 103 million XRP, and the compromise of XRPH Wallet that cost users $452,000. The current tactic skips the code exploit entirely. It’s just psychology: a familiar name, a plausible-looking address, a visible token entry. That combination can be enough to get someone to act before they think.
What Vet_X0 Actually Told Holders to Do
The advice from @Vet_X0 was blunt. Large banks, the contributor said, operate through internal gateways. They don’t need retail holders to sign transactions or redeem assets on their behalf. If something is asking you to do that, it’s not a bank. Per Vet_X0: “Just sit on your hands and do nothing.”
The only real confirmation step is checking the institution’s own official press site. Not a tweet. Not a Telegram message. Not an explorer listing. The corporation’s own press page. If Cross River Bank or Evernorth were actually behind a token or a wallet address, they’d say so there. The warning was direct: any offer that can’t be verified that way is a guaranteed loss of capital.
It’s pretty much that simple, and that’s why scammers keep doing it — most people don’t check.
The Broader Backdrop Making This Work
The scam doesn’t exist in a vacuum. Ripple’s institutional push, the XRP Ledger’s growing banking-sector integration, and the RLUSD stablecoin launch have all generated real, legitimate news. Evernorth’s 473 million XRP treasury deployment through major exchanges was a genuine headline. Cross River Bank’s RLUSD tests were real. Scammers didn’t create that credibility — they borrowed it.
And that’s what makes the current wave harder to spot than a cold phishing email. The underlying story is true. The institutions are real. The XRP Ledger really is being used by financial firms. But a fake token with a bank’s name in it isn’t connected to any of that. The names being copied belong to well-known companies whose actual announcements have nothing to do with the dummy assets.
An XRP Scan listing proves no authenticity. The confirmation step hasn’t changed: find the publication on the corporation’s own official press site, or don’t touch it.
Evernorth’s 473 million XRP deployment remains the legitimate benchmark here.
Hub: XRP price, news, and analysis
Frequently Asked Questions
How are scammers targeting XRP holders right now?
They’re creating vanity XRP Ledger addresses and fake tokens using names tied to real institutions like Cross River Bank and Evernorth, then pushing users toward phishing sites where real XRP gets stolen.
Does an XRP Scan or blockchain explorer listing prove a bank backs a token?
No — per the XRPL Foundation contributor @Vet_X0, a listing only confirms the asset exists technically on the ledger; the only real verification is a publication on the institution’s own official press site.
