Xaman Wallet Impersonation / XRP Airdrop Phishing (2026)
Summary
Beginning at least as early as March 2026 and escalating sharply through May 2026, a sustained and coordinated phishing campaign has impersonated Xaman Wallet — the dominant self-custody wallet for the XRP Ledger, developed by XRPL Labs — across fake social media accounts, counterfeit domains, fraudulent browser extensions, and fake desktop wallet applications. Xaman founder Wietse Wind confirmed on May 23, 2026 that more than 20 fake X/Twitter accounts and more than 10 fraudulent domains are created daily as part of this campaign. The legitimate Xaman product and XRPL Labs are the impersonated party and bear no responsibility for the fraudulent activity.
Connected Entities
1 entities · 10 linked investigationsTimeline(9 events)
2025-04-01
Wietse Wind issued an earlier warning (approximate date) that impersonation accounts were sending direct messages promoting fake Xaman web wallets and browser extensions, indicating the campaign predates 2026.
The Crypto Basic2025-08-11
Wietse Wind warned publicly: 'Scammers are sending emails about interruptions and Xaman desktop clients. THIS IS FAKE! THIS IS SCAM!' — indicating fake desktop-client phishing emails were circulating by at least August 2025.
Times Tabloid2026-02-16
Wietse Wind issued a detailed coordinated-scam warning covering fake sign requests, fraudulent NFTs, counterfeit desktop wallets, fake support DMs, and phishing emails, as reported by KuCoin news.
KuCoin News / Cryptonews.net2026-03-01
Reports published of scammers sending unsolicited NFTs to random XRP Ledger addresses, luring recipients to malicious sites claiming to distribute exclusive Xaman 'beta access pass' NFTs.
MEXC News2026-03-05
Wietse Wind warned XRP users: 'There is NO browser plugin. There is NO desktop wallet.' A fraudulent Chrome extension falsely claiming to be Xaman's web version was identified, requesting unusual wallet permissions.
The Crypto Basic2026-05-14
David Schwartz, Ripple CTO Emeritus, issued a public scam alert: 'SCAM ALERT: There has been a huge escalation lately in airdrop and giveaway scams targetting XRPL users lately.' Schwartz warned that impersonation accounts for him existed on Instagram, Telegram, and other platforms.
CryptoSlate / BingX News2026-05-23
Wietse Wind posted on X: 'THERE IS NO DESKTOP WALLET! NO AIRDROP! STAY VIGILANT!' Wind confirmed 20+ fake X accounts and 10+ fake domains created daily impersonating Xaman, and disclosed the team spent entire weekends fighting the campaign.
Crypto.news / U.Today / Coinfomania2026-05-25
Multiple crypto outlets including CoinAlert News and Coinfomania published amplified coverage of Wind's May 23 warning, reaching broader audiences.
CoinAlert News2026-05-26
Coin Edition reported a community member ('Bigdealee') claiming to have lost approximately $400,000 in XRP to a Xaman impersonation scam. This is an unverified community report.
Coin EditionDecision Log
- hash: BbtBVpp1S74WYP4AL23s4kgRxqw1Cbw5e6pcv8M97wEY
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/2/2026, 8:26:23 PM
last updated: 6/2/2026, 8:27:26 PM
avoid.net — verified advice for a post-truth world