XRPL Insights
On-chain investigations, protocol analysis, live market trackers, and API documentation for the XRP Ledger.
Featured
3Who Bought FUZZY First
Eleven seconds after the FUZZY pool opened, two wallets held 18.44% of the entire supply — bought for 77.83 XRP at a marketcap of 363. Forty seconds later they had sold all of it, for a 667 XRP profit; the same stack is worth 1,875,472 XRP today. The launch itself was clean: the issuer's one and only payment sent 100% of supply into the AMM, so there was no allocation to be an insider on. Who the other 2,024 first-week buyers were, the FirstLedger memecoin circuit they came from, what marketcap each community paid, and why 46% of the liquidity now sits in project hands — one wallet of which was handed 15,508M LP tokens by the Fuzzybears NFT issuer.
Read the story Investigation/FeaturedThe D'CENT Drain, Day by Day: 12.4 Million XRP, Six Waves, One List of Keys
The 15 September sweep of 1,682 XRP Ledger wallets was the first wave of six, and the same keys were still in use on 25 September. Read to the second: one script whose first batch got the reserve arithmetic wrong, the richest wallets moved by hand, five more waves through 20 September, then two new collectors and five new deletion sinks: 7,393 wallets and 12.4 million XRP in all, 6,095 accounts deleted with their owners' keys, and 6.3 million XRP swapped to Ethereum through THORChain. What the ledger proves, what it cannot, and what our own detection caught.
Read the story Investigation/FeaturedInside D'CENT's App Wallet: a Website and a Blind Signer
D'CENT is known for its hardware wallets. Its phone app also carries a software App Wallet, and D'CENT has warned users of abnormal transfers limited to it. The shipped Android build, verified as Google Play's own and decompiled: the App Wallet's screen is a web page served from D'CENT's site, the page reaches the signer over a bridge with no origin check, and the signer approves any hash it is sent after a PIN, with no native display of destination or amount. The in-app dApp browser opens the same signer to any site and runs a remotely fetched, unsigned engine. Its optional social backup sends the recovery phrase to Wepin, a service IoTrust itself runs, which holds the key that opens it. What the app proves, what it cannot, and the four changes that would break the chain.
Read the storyOriginal research
271,500 Payments a Second on the XRP Ledger Testnet
Half an hour of the XRP Ledger Testnet at full load: how many payments a second actually succeeded, how many were refused or expired before reaching a ledger, and what happened at 2,000 a second.
AnalysisWhere the XRP Ledger Runs Out of Room
The XRP Ledger Testnet stalled at 2,000 payments a second. The rippled source shows the six places work waits — dropped relays, voting on disputes, one lock around the open ledger, a close that stops everything else — and what would raise the limit.
InvestigationTrensik Is One Operator Trading With Itself
Trensik sells “verified RWAs” on the XRP Ledger: 13 private companies, 39 synthetic stocks, 30 Japanese shares. In 86 of its 94 markets one wallet made over 90% of every trade, 50 of its holders were created within an hour of the launch post, the company websites sit on one server registered days before their tokens, and the server behind its stock issuer holds trensik.com’s certificate. The dollar it prices everything in has taken in 36,783 RLUSD; DefiLlama counts it at $105M. A second storefront, DexDad, sells the same list on Uniswap’s interface. No name, company or address anywhere.
InvestigationVolta Wallet's Recovery Phrase Is Made on Its Server
Volta Wallet, by XRPayNet, is sold on Google Play and the App Store as fully non-custodial: 'your private keys stay with you'. Its Android build 5.0.5, decompiled: the app asks XRPayNet's server for the recovery phrase, posts it back in plain JSON, and sends it again inside every transaction it confirms. Not one line of key-derivation or signing code exists on the phone; even the addresses come from the server. On the XRP Ledger, the wallet XRPayNet's own domain file names as the app's has activated 226 accounts that hold 67,520 XRP today. Every finding with its location in the code, and what would fix it.
InvestigationThe XRPH Wallet Hack: 4,011 Wallets Emptied, and Every Key Was Guessable
On 3 September 2026 an address created 31 minutes earlier received the whole balance of 4,010 XRPH Wallet users: 267,664 XRP and 23.2M XRPH, biggest wallet first, 90% of it inside half an hour. The XRPH was sold on XPMarket while the sweep was still running (price down 91%), and 311,613 XRP left through two fresh hops into NEAR Intents. XRP Healthcare confirms the count and puts the loss at about $452,000, now sitting as DAI on Ethereum. Minute-by-minute timeline, every transaction hash, who the victims were, and why a single-sweep detector cannot see this shape. Then the cause: the app built every wallet's key from Math.random() and passed it to the key generator as text, collapsing the keyspace to about 2^46 so every key it ever made can be rebuilt offline.
On-Chain546 NFTs, Provably Fair: Verify the Bored Apes XRP Club Fairdrop
546 NFTs went to 294 of 1,767 holders, proportional to holdings — the amounts are exact integer math with zero randomness. The only random step, which ape goes to whom, was seeded by SHA-256 of ledger 106676929's hash, committed to on-chain 72 ledgers before that ledger existed. Every hash, both commitment memos, the exact preimage strings, and a one-command verifier that re-derives all 546 transfers byte-for-byte.
AnalysisThe Nine XRPL Addresses Behind FXRP
FXRP is XRP locked on the XRP Ledger so a copy can be used on Flare. The lock-up sits in exactly nine addresses — all nine returned by a Flare contract call, not curated by us. Read at one ledger they hold 148,259,398 XRP against 148,161,053 FXRP, covering with 98,345 XRP to spare. But 94.4% of that reserve is invisible to a balance check: 140M XRP sits in fourteen 10M escrows on the Core Vault, expiring one a day for fourteen days. Miss them and the reserve reads as 5.6% backed.
AnalysisWe Priced $100,000 of XRP on Solana
A viral post says it's cheaper to buy XRP on a Solana DEX than on XRPL's native AMM. We priced $100k on both, same afternoon, screenshots and public APIs. Half right: the AMM alone quotes ~5% under the wider XRPL market. But Solana's $100k quotes are market-maker RFQs priced off its pools - set Jupiter to its on-chain router alone and it answers NO ROUTES FOUND, try reducing to 55.6K (9.74% impact already at $50k). wXRP's float is $840k with live custodian freeze authority; the XRPL fills the whole order on-chain at 0.19% impact. Same-stable check: Circle's native USDC on the XRPL - a market the size of wXRP's whole Solana footprint - fills $50k at 0.36% where Jupiter takes 9.74%.
AnalysisHow Much XRP Token Creators Have Cashed Out
A destination tag identifies one account at an exchange, so creator cash-outs are on the public ledger. Across 15,982 token flow graphs, 708 creators sent 7.24M XRP to exchange deposit tags — median 200 XRP each. Full venue breakdown including ChangeNOW, FixedFloat, SimpleSwap and SideShift, plus the three exclusions that cut the raw 1.89B total by 99.6%: recipient deposits, 189 "creators" that are themselves exchanges, and 6 swap/bridge wallets moving 66M XRP.
InvestigationXORA Finance: An Investigation Into Withdrawal Issues
Twenty-two hours after we asked XORA in public why its users cannot withdraw, it announced a $5.5M bitcoin treasury. The ledger shows it minted that “BTC” itself — in a wallet its own treasury created, with one holder, no order book, no AMM pool and no bitcoin behind it. Plus the case that started it: 29,899.8 XRP under tag 287588244 sitting in the treasury XORA published, users frozen the moment they request a large withdrawal, and a 15,000 XRP wallet deleted 16 minutes after the treasury created it.
InvestigationThe Manifest-Revocation Flood: Why XRPL Nodes Are Losing Peers
On 2026-07-31 a flood of 223,303 fabricated validator-manifest revocations hit the XRP Ledger overlay in 10 seconds, and 46 seconds later peers began dropping with "onReadMessage: No message of desired type". The mechanism traced to rippled's 26-bit frame length field, with downloadable log evidence. Consensus was never affected.
AnalysisInside XRPL Ledgers 1-32570: Reconstructing the Lost History
The XRP Ledger's first 32,569 ledgers are gone from every server on Earth. Ledger 32570 holds enough to rebuild them: exactly 368 transactions proven by fee arithmetic, 382 recovered ledger hashes, 163 orphaned transaction IDs, and the full initial distribution of 100 billion XRP across 136 accounts.
AnalysisWhere the First 100 Billion XRP Went
XRPL history begins with 100 billion XRP across 136 accounts. Twenty-five days later the account holding 80% of it — attributed to Ripple Labs — moved 79 billion XRP to nine addresses in five minutes and twenty seconds. Those nine hold 856 XRP today.
InvestigationThe Coreum Bridge Released 200,000 XRP. It Wasn't Rippling.
On 9 August 2026 the Coreum XRPL bridge account sent ~200,000 XRP to two wallets created that same afternoon, in 97 minutes. A widely-shared warning blamed rippling and the DefaultRipple flag — but every payment was signed by 17 of the bridge's 28 relayer keys, and native XRP cannot ripple at all. Tracing both public chains, the real cause is a relayer that counted the attacker's own memo-tagged self-payments as deposits — minting a balance that was bridged back out. Full timeline, the phantom-deposit mechanism with the exact contract and relayer code, the Coreum-side attacker account, and every transaction hash.
InvestigationThe Rippling-Drainer Botnet: Fake Same-Code Tokens That Empty Wallets
On-chain investigation into a 7-wallet botnet that mints counterfeit RLUSD/USDC/XAH tokens and ripples the real ones out of wallets that left rippling enabled. Funding graph, transaction hashes, and how to protect yourself.
InvestigationThe Horizon Bot Network: 254 Wallets, One Kraken Account
On-chain investigation: the wallet behind the Horizon (sourceTag 111) fee collector also controls a 254-wallet trading fleet, proven by a shared Kraken deposit tag. Full money trail with addresses and transaction hashes.
AnalysisXRPL Front-Running vs Ethereum MEV: A Mechanism Comparison
Is front-running on the XRP Ledger the same as Ethereum MEV? A neutral, source-backed comparison: same intent, different physics — EVM sells transaction order for money, XRPL assigns it with an unpredictable per-ledger random salt.
AnalysisHalf of Solana’s Transactions Are Not Transactions
Solana’s 3,191 TPS headline falls to about 1,092 once validator votes and failed transactions are taken out — two of every three it reports are one or the other. XRPL does 12.9, but reaches finality in 3.55 seconds against Solana’s 13.5. Measured over an hour of Solana and 200 XRPL ledgers.
AnalysisPriced by the Byte: Solana Charges Per Byte, XRPL Per Object
Pulled from Solana mainnet RPC: rent is exactly 6960 lamports per byte, identical for every account. XRPL’s flat per-object reserve produces a 43× spread — dearer than Solana for tickets and trust lines, 22× cheaper for a full NFT page. What each chain got for its choice, and why unpaid validators make cheap state riskier here.
AnalysisThe Reserve Was Never a Fee
In December 2012 rippled’s authors deleted the 1,000 XRP burn that account creation cost and replaced it with XRP you keep but cannot send. The founding commits, every reserve value ever enforced — including a 2021 cut that flip-flopped thirteen times before it stuck — and an evidence-based case against cutting from today’s floor.
AnalysisWhat an XRPL Account Has Cost, 2013-2026
Every reserve change read straight off the ledger by bisecting the FeeSettings object, then priced in USD at the time. The reserve fell 50x in XRP terms — from 50 XRP to 1 — but the dollar cost peaked at $55.60 in January 2018.
AnalysisWhy XRPL Tokens Can't Be Airdropped
Tested on testnet: IOU, MPT and NFT all refuse delivery to a recipient who has not opted in — the same AMM swap succeeds with a trustline and returns tecPATH_DRY without one. Why the ledger requires the holder to sign, how Solana and Ethereum differ, and the airdrop designs that work.
On-ChainXRP Burned by Xaman Token Creator
124,200 XRP permanently burned across 1,242 launches through the Xaman Token Creator xApp.
On-ChainDubai Real Estate Tokenization on XRPL
Live tracker for the Dubai Land Department PRYPCO Mint project. Property tokens issued via Ctrl Alt on the XRP Ledger.
SecurityXRPL NFT Scam Tracker - Live Drain Data
Live tracker of the XRP-API.com NFT phishing-drain campaign targeting Xaman users via "Safe XRPL verify message" memos. Total XRP and tokens drained, top scammer wallets, monthly timeline.
SecuritySandwich Attacks on XRPL
How front-running works on the XRP Ledger DEX, why high slippage makes you vulnerable, and how to protect your trades.
SecurityHow the XRPL.to Wallet Protects Your Keys
OS-sourced entropy, AES-256-GCM, and a hard 600,000-iteration PBKDF2 floor calibrated up to 4,000,000 per device. Slow hardware waits — it never gets weaker crypto.
Live trackers & market data
20XRPL Bridge Premium Tracker - Cross-Chain Arbitrage Monitor
Live gap between Axelar-bridged tokens on the XRPL DEX and their real source-chain price, read on-chain. A large premium is the leading signal of a cross-chain arb dump — the pattern behind the SOIL +11x pump and crash.
Market DataXRPL NFT Rarity Checker & Analytics
Check rarity rankings, floor prices, holder distribution, and sales history for every XRPL NFT collection.
Live DataXRPL NFT Sales Volume & Market Stats
Track NFT sales volume, top collections, floor prices, and market activity on the XRP Ledger.
Market DataXRP News Aggregator & AI Sentiment Analysis
Free XRP news feed with AI-powered sentiment scoring. Track bullish, bearish, and neutral trends in real time.
Market DataXRPL Meme Coins - Live Prices & Rankings
Track the hottest meme tokens on the XRP Ledger with live prices and trading data.