Where 1,509 XRP Went
Someone tapped what looked like a free NFT and lost 1,509.02 XRP. The trap had been sitting in their wallet since May, addressed to them and nobody else, priced at almost exactly what they had. This is what happened, and where the money is now.
Where the money went
Start with the answer. The money moved three times in five days, and part of it has not moved at all.
The important hop is the middle one. ChangeNOW is a service that swaps one coin for another, and payments into it carry a destination tag — a number that tells the company which of its customers the money belongs to. That tag, 133380322, is the single point on this whole trail where the money touches a company that knows who it is dealing with. Nothing on the ledger itself names anybody.
The other 521.27 XRP is still sitting in two wallets in the open, untouched since it arrived.
What they actually signed
They thought they were claiming a free NFT. What they signed was a purchase.
On the XRP Ledger, anyone can create a sell offer and address it to one specific wallet. Only that wallet can accept it. Nobody else sees it, nobody else can take it, and it stays there until it is accepted or cancelled. Accepting one means buying — so the single tap sent 1,509.02 XRP out and brought a worthless NFT in.
| Paid | 1,509.019636 XRP | in one transaction |
| Had in the wallet | 4,470.508085 XRP | just before accepting |
| Received | ANIMAL FAM #335 | a copy of an NFT they already owned |
| When | 28 Aug 2026, 14:49 UTC | ledger 106,602,212 |
No password was stolen and no wallet was hacked. The transaction is completely normal and completely valid. That is what makes this kind of scam work: the only thing that went wrong is that a person pressed accept.
The transaction: 2ED37C656E96C55B8131D49877F9B0C30BD7043D47A14DC8F6F29C39428F5112
The price was copied from the victim's wallet
This is the part that gives the scam away.
Think about what a normal sale looks like. A seller decides what their artwork is worth. They have no idea how much money is in your wallet, and no reason to care. So when the asking price turns out to be a fixed slice of your balance, it was never a price at all. It is a withdrawal, and the NFT is just the thing that gets you to sign it.
The balance at the exact moment the offer was created, one ledger earlier, matches it to the smallest fraction of an XRP.
Then it waited three months
Nothing had to happen in those 94 days. The offer simply sat in the wallet, costing its author nothing, until a moment of inattention. That is also why the loss looks like a third of the wallet rather than almost all of it — the price was locked in back in May, and the buyer had saved more XRP since.
The seller was the sixth wallet in a chain
The wallet that took the money was not somebody’s normal account. It was one link in a chain that moves on every few days, and it works the same way every time: create a batch of fake NFTs, send addressed offers to hundreds of people, destroy the fakes nobody took to get the deposits back, then delete the wallet and start again in a new one.
Add it up and this operation made 2,266 fake NFTs and sent 2,778 offers to roughly seven hundred wallets over four months — and got one person. It is worth doing anyway, because leaving an offer lying around is almost free.
Why the fakes look completely real
The fakes are brand-new NFTs the scammer created. What they copied is the link to the picture.
An NFT does not contain its image. It contains a web address pointing at one. So the scammer pointed their worthless NFTs at the real collection’s own image folder. Your wallet follows the link, fetches the genuine artwork and the genuine name, and shows them next to a token that has nothing to do with that project.
The batch created after this drain includes 58 copies of Black Market Dawgs — a real collection of 9,797 NFTs made by rYL3n9…RZkw — all pointing at that collection’s own images.
If you own the real one, nothing has happened to it
A fake is a separate NFT with its own identity. Sharing an image link gives its maker no claim on yours, and the real collection is untouched. The only way to lose anything here is to accept an offer.
The next batch is already waiting
The 200 XRP that did not get cashed out paid for a new wallet, which spent 43 minutes creating 106 more fakes and sending out offers. Those offers are still sitting in people’s wallets right now.
The biggest one asks 44,330 XRP of a single wallet, rQ9AuF…VCQm. Nobody has taken any of them.
What to do if one shows up
Treat any NFT offer you did not ask for as hostile, and cancel or ignore it. There is no situation where accepting a surprise offer pays you money — accepting a sell offer always means spending. If you are not sure which kind you are looking at, do nothing: the offer cannot do anything on its own.
So who is he?
The ledger will not say, and it is worth being exact about what that means rather than leaving it as a shrug.
Everything he did is public and permanent — every wallet, every fake, every offer, every payment, timed to the second. What none of it contains is a name. An XRPL address is just a key that somebody holds, and it only becomes a person when it touches something that already has a name attached. He was careful that it never did. We went looking for that in every form it could take across all eight wallets, and there is nothing there.
We also checked whether the stolen XRP ever came back onto the ledger after it was cashed out. It does not. As far as the public record goes, it left for another chain or it is still sitting in an account at that company.
So the trail does end — but it ends in two specific places rather than in the dark. It begins at Coinbase, which is where the money that set the whole operation up came from, and it finishes at ChangeNOW, which is where the stolen XRP went. Both of those are companies that know who their customers are. Neither will say so on request from a stranger, and neither should. That is what a police report exists to do.
Which is why the 521.27 XRP that has never moved matters more than it looks. It is still sitting in the open, and the day it moves, it has to move somewhere.
Check it yourself
Everything above is public. You can open the sale and the ChangeNOW deposit in any XRPL explorer and read the amounts and the tag straight off them.
For the price test, look up the buyer’s wallet rnnS4e…ZoVA at ledger 104,484,031 — the one before the offer was created — and divide the asking price by the balance. For the chain of wallets, each one’s history shows the payment that created it and the deletion that emptied it into the next.
Every wallet named here is on our public scam address list, which any wallet or marketplace can check before letting someone sign. More work like this in our insights.