Xaman Wallet Impersonation / XRP Airdrop Phishing (2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·3Aa6D6…mm4WSummary
Beginning at least as early as March 2026 and escalating sharply through May 2026, a sustained and coordinated phishing campaign has impersonated Xaman Wallet — the dominant self-custody wallet for the XRP Ledger, developed by XRPL Labs — across fake social media accounts, counterfeit domains, fraudulent browser extensions, and fake desktop wallet applications. Xaman founder Wietse Wind confirmed on May 23, 2026 that more than 20 fake X/Twitter accounts and more than 10 fraudulent domains are created daily as part of this campaign. The legitimate Xaman product and XRPL Labs are the impersonated party and bear no responsibility for the fraudulent activity.
Connected Entities
2 entities · 60 linked investigations- Xaman Wallet Impersonation / XRP Airdrop Phishing (2026)→mentioned with→KuCoin(60%)
Connected Through
1 shared actor · 95 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦KuCointoken
Timeline(9 events)
April 2025
Wietse Wind issued an earlier warning (approximate date) that impersonation accounts were sending direct messages promoting fake Xaman web wallets and browser extensions, indicating the campaign predates 2026.
The Crypto Basic11 August 2025
Wietse Wind warned publicly: 'Scammers are sending emails about interruptions and Xaman desktop clients. THIS IS FAKE! THIS IS SCAM!' — indicating fake desktop-client phishing emails were circulating by at least August 2025.
Times Tabloid16 February 2026
Wietse Wind issued a detailed coordinated-scam warning covering fake sign requests, fraudulent NFTs, counterfeit desktop wallets, fake support DMs, and phishing emails, as reported by KuCoin news.
KuCoin News / Cryptonews.netMarch 2026
Reports published of scammers sending unsolicited NFTs to random XRP Ledger addresses, luring recipients to malicious sites claiming to distribute exclusive Xaman 'beta access pass' NFTs.
MEXC News5 March 2026
Wietse Wind warned XRP users: 'There is NO browser plugin. There is NO desktop wallet.' A fraudulent Chrome extension falsely claiming to be Xaman's web version was identified, requesting unusual wallet permissions.
The Crypto Basic14 May 2026
David Schwartz, Ripple CTO Emeritus, issued a public scam alert: 'SCAM ALERT: There has been a huge escalation lately in airdrop and giveaway scams targetting XRPL users lately.' Schwartz warned that impersonation accounts for him existed on Instagram, Telegram, and other platforms.
CryptoSlate / BingX News23 May 2026
Wietse Wind posted on X: 'THERE IS NO DESKTOP WALLET! NO AIRDROP! STAY VIGILANT!' Wind confirmed 20+ fake X accounts and 10+ fake domains created daily impersonating Xaman, and disclosed the team spent entire weekends fighting the campaign.
Crypto.news / U.Today / Coinfomania25 May 2026
Multiple crypto outlets including CoinAlert News and Coinfomania published amplified coverage of Wind's May 23 warning, reaching broader audiences.
CoinAlert News26 May 2026
Coin Edition reported a community member ('Bigdealee') claiming to have lost approximately $400,000 in XRP to a Xaman impersonation scam. This is an unverified community report.
Coin EditionDecision Log
- slot 423881809 · hash BbtBVpp1S74WYP4AL23s4kgRxqw1Cbw5e6pcv8M97wEY
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/2/2026, 8:26:23 PM
last updated: 6/2/2026, 8:26:23 PM
3 viewsavoid.net — verified advice for a post-truth world