A large-scale yet technically primitive attack targeting $XRP Ledger asset holders has erupted on social media platform X. XRPL full-stack developer, Andrew Spencer, exposed massive reporting notifications in which fake accounts tag users under posts about the launch of “Season 1” of a supposed 10 million Ripple USD ($RLUSD) stablecoin distribution.
Scammers are disguising themselves as official organizations, including the Xaman wallet and the XRPL Foundation (XRPLF). However, community representatives have officially stated that no $RLUSD airdrop exists – it is a scam.
Why blocking bots won’t protect your crypto wallet anymore
The main feature of the current campaign is not the phishing itself, but the delivery method, as attackers have fully automated the process using networks of bots. They instantly generate new accounts, publish posts mentioning hundreds of real users, and disable comments from outsiders so nobody can post warnings.
Spencer complains that it is impossible to “unsubscribe” from these chains of mentions. XRPL community activists are expressing concern that standard client-side protection methods such as blocking accounts and hiding notifications only mask the problem for individual users, while the bot farms continue operating freely in the background.
🚨⚠️ Scam Alert ⚠️🚨
There is no @XamanWallet foundation
Magnetic is not Airdropping ethereum:0x8292bb45bf1ee4d140127049757c2e0ff06317ed
The official $XRP Ledger Foundation is @XRPLFAlways do your own research !! #XRPL #Xaman #Xahau pic.twitter.com/D4UgfrbySb
— Handy Andy {X} 🪝 𝗫▸ (@Handy_4ndy) May 18, 2026
The scheme exploits the high level of interest surrounding Ripple’s real stablecoin $RLUSD. Scammers follow the classic playbook, instilling victims with a false sense of urgency and FOMO, forcing them to visit phishing websites, connect their wallets such as Xaman, and sign malicious transactions, including activating hidden Trust Lines or wallet-drainer scripts.
Earlier, Ripple’s David Schwartz had already urged the community to remain extremely vigilant. He emphasized that attackers are not inventing fundamentally new tools, but are instead relying on scale and intensity. The campaign includes both bot attacks on X and AI deepfakes impersonating Ripple executives on Telegram and TikTok.
Officials remind users that the real XRPL Foundation and Ripple never conduct sudden public token giveaways, never require wallet verification through third-party websites, and never ask for seed phrases. Any offer of “free” $RLUSD on social media is a guaranteed scam.