XORA Finance: An Investigation Into Withdrawal Issues

We begin with the most recent development, because it happened while this article was being updated and it answers the question the rest of the piece spends its length circling: what is actually behind this platform. The sequence in which it appeared matters as much as the thing itself.

On 4 August at 01:08 UTC we put the users' reports to XORA and its founder in public, replying to both accounts: "Here some of the users claiming withdraw issues on Xora Finance all using the correct domain", with three of them linked. Neither account replied. @joren has not posted publicly since 3 August. @xora_finance went on posting through the day — two hiring adverts, a Ripple news link — and then, twenty-two hours after we asked, did this instead.

The treasury wallet itself still holds no tokens — it has zero trustlines, which as we show later means it cannot hold one, and it has never traded, lent or provided liquidity in its life. What it did instead was create the machinery next door. On 24 July, two seconds apart, it funded two brand-new wallets with 2 XRP each. One of them, rcj4KrKzMTMX1JcQ2a7KsrEeEQKYSn3Rz, issues a token whose currency code is BTC. The other, rsaBZHZWHqW9TSrCkAqfHKH5FEgKPiHKfe, holds it. Nobody else does. On the XRP Ledger anyone may issue a token and call it anything; "minting" here is typing a number into a payment. No bitcoin is involved at any point, and none was bought.

Three payments, totalling 85.69860674 "BTC". Note the trustline limit: the holder set it to 21,000,000, the supply cap of real bitcoin. Note also the 0.000002 XRP ping 22 seconds in — it comes from rhVGXf3KKNa2nox1544s4sVrDw3NSfwwUB, the same wallet that pinged the 16-minute burner wallet described below, 19 seconds after the treasury created that one. The same hand sets up both.

Before the detail, here is the whole case in the order a depositor would meet it. Each point is documented further down, with hashes.

Any one of these has an innocent explanation available. Together, and in a platform holding other people's money, they describe something that has a name in this industry, and the last item is the one that usually arrives at the end.

The rest of this article is the investigation that led us to ask XORA the question it answered with a mint. It runs in order: the dispute that started it, whether the money arrived, what the treasury does with it, and who is behind the platform.

On 3 August 2026 a depositor posting as @gimgyeongh62101 published a timeline of his attempt to withdraw 29,899.8 XRP from XORA (xora.finance, @xora_finance), together with screenshots of both conversations. He is careful in it: "I am not making accusations. I am simply asking XORA to clarify the apparent inconsistency." The inconsistency is that he was given two explanations that flatly contradict each other — an account frozen under review, and an account that never existed. As it turns out there is a way both could be uttered honestly, and it is worse than either.

Phishing against XRP holders is real, and warning people about it is legitimate. But an account that is frozen under an AML hold and an account that never existed are not the same account, and the second explanation makes a specific, checkable claim about where the money physically went. That part does not depend on anyone's word. So we checked it.

Screenshots can be edited, so we treat them as claims rather than proof — with one exception noted in the next section: the exchange receipt he published contains a transaction hash that matches the validated XRP Ledger exactly, which is not something a screenshot can fake.

Two validated payments carry destination tag 287588244. Both were sent to rhbErkS2d4H82tRbdGyFkhhc4LNtjKaC3o, both succeeded (tesSUCCESS), and both came from hot wallets of major exchanges (labels are public and explorer-verified):

The pattern is a careful retail depositor, not a victim mid-phish: an 8.7 XRP test payment first, then the full amount 37 minutes later — from two different exchanges (Bybit, then Binance), both re-using the same destination tag. The main payment settled in ledger 105,566,760 on 2026-07-13 at 09:02:02 UTC and moved the destination wallet from 95,648.31 to 125,548.11 XRP — at that moment the disputed deposit was roughly a quarter of everything the wallet held.

The destination is not an attacker's address. It is the wallet XORA itself published. XORA's own about page — archived at web.archive.org on 2026-06-03, five weeks before the deposit — reads:

"All user XRP is pooled in a single shared treasury wallet on the XRP Ledger. Each user deposit is routed via a unique destination tag that maps it to that user's account. Treasury balance and inflows are publicly verifiable on-chain: rhbErkS2d4H82tRbdGyFkhhc4LNtjKaC3o"

The same page answers "Where can the XORA treasury be verified?" with the same address, "viewable on XRP Ledger explorers such as livenet.xrpl.org or xrpscan.com." XRPScan carries a verified label for the wallet: "Xora Finance", domain xora.finance, X handle @xora_finance. XORA's site also published step-by-step guides for exactly the flow this depositor used — "Deposit XRP from Binance to XORA" (a Bybit version too), instructing users to withdraw from the exchange with "the destination tag shown in your account."

The wallet's behaviour matches that description. Since its activation on 2026-03-08 it has received 2,269 successful inbound payments across 1,723 distinct destination tags — a custodial deposit wallet running a per-user tag scheme, exactly as the about page said. Tag 287588244 is one of those tags, and it received exactly two payments: the test and the 29,899.8 XRP.

A ledger records payments, not sign-ups. It cannot show who opened an account, so on its own it cannot prove or disprove that this depositor registered one. What it can do is test the phishing explanation against what actually happened on-chain, and that explanation has to answer all of the following.

• Phishing of this kind normally steals by substituting the attacker's address. That is exactly what the South Korean case XORA points to did: in the Fxrpntwork.com fake-Flare operation, victims sent their XRP to wallets the fraudsters controlled. Here the opposite happened — the funds went to the treasury wallet XORA published on its own website, so the XRP ended up in XORA's custody with no third-party phisher on the receiving end of either transaction.
• The tag behaves like a real account. XORA's own materials say each destination tag maps to one user's account. Tag 287588244was used twice, 37 minutes apart, from two different KYC exchanges — and by the depositor's account, XORA support matched that same tag and his email to "his account" and placed it under an AML hold. The support version of events is the one consistent with the chain.
• The money is fully traceable on both ends. The deposit came from Binance and Bybit hot wallets — withdrawals from the depositor's own exchange accounts, where his identity is KYC-verified.
• No refund is visible. As of 2026-08-03 there is no outgoing payment from the treasury that returns the deposit or anything near it to the depositor.

There is one scenario that would reconcile the founder's statement with the ledger, and we should state it plainly rather than leave it out: a criminal opens a genuine XORA account with their own wallet, attaches the victim's email address to it, and points the victim at it through a fake front-end. The tag would then be real and XORA-issued, the emails the victim received would be real, and the victim would still never have registered anything. The ledger cannot exclude that, because none of it happens on the ledger.

It is not, however, a free explanation. It requires that XORA's sign-up allows one account to carry another person's email address; it predicts that XORA's own withdrawal-confirmation emails for the cash-outs of 14 and 16 July would have reached the depositor, who instead spent the following week asking where his withdrawal was; and it does not explain a "manual AML hold (withdraw freeze + lifetime cap 0)" described in the present tense on 26 July, ten days after the balance would already have gone. XORA can settle all of it in one step, and we asked: publish the wallet that registered the account behind tag 287588244 and the date the email was attached to it. Both are checkable against the chain in minutes.

Put to us directly, XORA's founder described a ring of roughly thirty victims, about $20m stolen, South Korean police involvement, and an entry point of a QR code scanned physically in Korea. Those figures were given to this publication in a message, not published anywhere, so we quote them as his account rather than as established fact. There is a documented South Korean case matching most of them, and it is not XORA's.

In October 2025 a fake site impersonated Flare Network and its FXRP staking product — named by Decrypt as Fxrpntwork.com, which also reports that investors were "directed to move XRP off domestic exchanges, through overseas venues, and into wallets the group controlled". Seoul police report 3.4 million XRP taken from 71 investors — about $8.5m, with up to $19m the scammers may have taken in total — promoted through blog posts, articles and YouTube videos. CoinDesk reports two people detained on aggravated fraud charges with an Interpol Red Notice sought for a third who had left the country; Decrypt puts the arrests at three with a fourth abroad. The outlets differ on the count; they agree on the mechanism.

Three details stop that case from explaining this one. It had 71 victims, not thirty. It was seeded through blogs and video, not a physical QR code. And its victims sent XRP to wallets the fraudsters controlled — the ordinary phishing pattern, and the opposite of what happened here, where the money went to XORA's own published treasury. XORA's own alert of 3 August describes the police matter as one the authorities probe "separately".

That distinction matters because the founder did not gesture vaguely at Korean fraud. He identified this depositor with that specific case: "He was one of those Koreans who fell victim, that police case that got posted about recently." The reporting he refers to went out on 30 July 2026, four days before the depositor published. And the defining fact of that case is that its victims paid wallets the fraudsters controlled — while this depositor's 29,899.8 XRP went to the treasury address XORA published on its own website, under a tag from XORA's own tag space, where it can still be seen. Both cannot describe the same money. The claim that he is one of those victims does not fit the payments it is offered to explain.

The separate assertion appended to it — "There was a fake Xora website as well" — remains unsubstantiated. We searched for one and did not find it. We did find a fraudulent site trading on the name, covered further down, but it is a counterfeit bank with no XRP anywhere in it, and it could not have produced the deposit tag this dispute turns on.

XORA's founder said a fake XORA website existed, and nobody has ever named one. There is a fraudulent site trading on the name — xorafinance.com, against the real xora.finance — and it deserves a warning of its own. But it is not a clone of XORA, and it cannot be the site in this dispute. We are stating that plainly because we initially thought otherwise.

Across its homepage, sign-in and registration pages, xorafinance.com contains no occurrence of "XRP", "XRPL", "Ripple", "crypto", "wallet", "token", "blockchain", "deposit", "yield", "staking" or "APY". It carries no XRP address and no destination-tag field anywhere. It therefore could not have issued the per-user tag at the centre of this dispute, shown anyone an XRP balance, or produced a withdrawal screen. Its design is a pale corporate-bank template, not XORA's dark crypto interface.

What it actually impersonates is a bank. It claims "$3T+ Assets Managed" and "200k+ Employees", uses Bank of America's exact brand navy and its corporate purpose statement verbatim, and a careless find-and-replace has left the string "BIN" spliced through real words — "CapaBINlities", "visiBINlity", "SustainaBINlity". Its registration flow is gated behind email verification and then asks for a government ID or passport and a proof of address, both required, plus source of funds and expected monthly transaction volume. A live-chat widget offers "support". Anyone who completed that flow has handed identity documents to a stranger, which is a worse loss than money, and it is the reason we are naming the domain at all.

One correction we owe the record. The depositor wrote that from 24 July he emailed [email protected] alongside the genuine [email protected]. That first domain — spelled without the second "i" — is not registered at all: no address record, no mail server, and a registry lookup returns no match. Mail to it cannot be delivered and cannot be answered. By his own account the emails went unanswered — "there was no reply" — and the response came only after he posted publicly, in the direct message quoted at the top of this article, which asks him to confirm his email, supply a Telegram handle, and state the amount and destination. So the document request he describes arrived through that channel, not from the website. We had earlier connected it to the scam site's harvesting flow; that connection was wrong.

Into the pool. XORA's stated design is that all user XRP is commingled in this one wallet, so the specific coins cannot be singled out once deposited. What the ledger does show is the pool's behaviour after the deposit landed: in the three weeks that followed, roughly 133,800 XRP left the treasury in payments of 1,000 XRP or more. The largest and most repeated destinations are instant-swap services — ChangeNOW received 42,600 XRP across three payments (the first of them 18 hours after the deposit), FixedFloat 15,000 XRP — plus 14,000 XRP each to two tagged exchange-style deposit wallets.

Despite the outflows, deposits kept arriving, and as of 2026-08-03 the treasury holds about 214,185 XRP — roughly seven times the disputed deposit. The funds to make this depositor whole are sitting in the wallet today.

The dispute reads like one depositor's bad luck until you look for others. Four separate people, across six weeks, describe the same failure in the same words: the withdrawal is accepted, the interface reports it complete, and nothing ever appears on the XRP Ledger.

The two June reports matter most, because they land a month before this dispute and before the imitation site's certificate was issued — and both users were addressing, and were blocked by, the genuine @xora_finance and its founder. A counterfeit website does not block you from the real company's account.

We went through every payment this wallet has ever received and every payment it has ever sent. The picture is simple: many people have tried it with pocket change, a handful of people trusted it with serious money, and serious money has never come back out.

These are all seven payments of 10,000 XRP or more the treasury has ever sent. Click any hash to open it in an explorer and read it off the validated ledger yourself. Not one of them went to a customer wallet.

Three went to ChangeNOW and one to FixedFloat — no-KYC instant-swap services. A swap service converts XRP into another coin and sends it to a different blockchain: after that hop, the money cannot be followed on the XRP Ledger at all, and no identity is attached to it anywhere in the process. ChangeNOW has never deposited into the treasury; FixedFloat's only inbound payments are 2,784.95 XRP returning on 2026-05-13 and 4.59 XRP on 2026-07-31. So none of these large payments can be a customer taking their own money out.

Two more went to wallets that simply pass money along. rJt8MVK… has forwarded 1,563,093 XRP onward to rwXnv8Bf…, which in turn is high-volume exchange infrastructure that has moved 204 million XRP into KuCoin hot wallets. Both keep almost no balance — money arrives and leaves. The seventh payment is the strangest of all.

On 27 July the treasury sent 15,000 XRP to a wallet that had never existed before — the treasury itself created it with that payment. Sixteen minutes later the wallet erased itself from the XRP Ledger and pushed the money onward. Here is its entire life, all three transactions:

An AccountDelete is permanent: the account is removed from the ledger and its whole balance is handed to one address. A wallet created, used once and destroyed inside seventeen minutes is a burner — the purpose of destroying it is that nothing is left to look at.

The address it swept into, rn6Cnr…, is not an ordinary wallet either. It collected 524 AccountDelete sweeps from 514 different short-lived wallets, paid the proceeds onward to swap and exchange wallets — including the same rwXnv8Bf… route to KuCoin — and then, on 29 July, deleted itself too, sweeping what was left to yet another address. This is layering: a structure whose only function is to break the chain between where money came from and where it ended up.

In fairness, single-use wallets are not automatically sinister — some services generate a fresh address per transaction and reclaim it afterwards. What is not ordinary here is that XORA's treasury created this wallet itself, funded it with customer money, and it was destroyed 16 minutes later into a hub that has done this 524 times and has since destroyed itself.

XORA says the yield it pays will move to "XRPL AMM liquidity provision and on-chain lending markets." Those activities are not private — every one of them would leave a permanent, public record on the XRP Ledger. We counted every transaction this wallet has ever signed, of every type. This is what is there:

That is the whole list. Money in, money out, and seven pieces of incoming noise it did not ask for. Specifically, these are the counts for everything a yield business would be doing:

The treasury has never provided liquidity, never traded, never lent, and holds no token of any kind — it has zero trustlines, which on the XRP Ledger means it literally cannot hold one. So the advertised return, currently up to 22% APY, is not being generated by anything this wallet does. XORA says as much themselves: the yield is "currently subsidised by the XORA treasury as a temporary bootstrap mechanism." Read plainly, that means today's depositors' returns are paid out of money the treasury already holds — which is money other depositors put in.

The security page also states that a "3-of-5 XRPL multisig migration is on the roadmap and should not be treated as live custody until the signer list is published on-chain." The ledger confirms that honestly: there is no signer list. Every XRP in the wallet sits behind a single private key held by one unnamed person.

For a custodial platform, this matters as much as the ledger: if the money stops coming back, who is accountable? We searched for the public record behind XORA and its founder. This is everything we could verify, and everything we could not.

X now shows an "About this account" panel on every profile, and @joren's is worth opening. The account was created in March 2014, which makes it look long-established — but the same panel records a username change in December 2025. The handle has carried this identity for about eight months, not twelve years, and that change lands two months before xora.finance was registered. Its blue check dates from March 2026, the same month the treasury was activated. The panel also gives the account's location as North America, while XORA's press material places the company and its founder in Stockholm, Sweden.

The whitepaper deserves a moment on its own. It allocates 15% of the token supply — 150 million tokens — to "Team & Development" on a 24-month cliff and 36-month vest: a named allocation, to a team that is named nowhere. We read it on 2026-08-03. It contains no founder name, no company, no legal entity, no jurisdiction, and not a single XRP Ledger address. It describes the model as "Auditable Custody: a segregated XRPL treasury account, per-user destination tags, daily reconciliation" — while giving the reader nothing to audit it with.

Two more things from XORA's security page are worth knowing before depositing. The "depositor reserve" meant to absorb losses is planned, not funded — XORA states plainly that "no reserve is funded today." And aggregate protocol metrics — how much they hold, how much they owe depositors — are "not published publicly to limit competitor and adversarial intelligence." So the total owed to users is undisclosed — the treasury wallet is published, but the size of the liability against it is not.

None of this is proof of wrongdoing, and a small startup being thin on public record is not unusual by itself. But XORA is not selling software — it is holding other people's savings, on the strength of a promise to give them back. The entire accountable identity behind that promise is one social-media handle. There is no registered company to sue, no regulator to complain to, and no named employee.

• If this person "never had an account", why did XORA support write "we matched your X account to XORA email … (tag 287588244)" and "we emailed [that address] about your account"?
• What is a "manual AML hold (withdraw freeze + lifetime cap 0)" applied to, if not an account? A lifetime cap of zero means the balance can never be withdrawn — on what basis was it set?
• If a fake XORA site was involved, how did it produce a valid per-user destination tag for XORA's real published treasury?
• Can XORA point to a single large withdrawal — any customer, ever — that was paid back on-chain? The largest payment the treasury has ever sent to anyone is 19,000 XRP, and it went to a swap service.
• Why did the treasury create a wallet on 27 July, send it 15,000 XRP of customer money, and have it deleted 16 minutes later into an address that has absorbed 524 sweeps from 514 wallets?
• Why were 68,631.71 XRP sent to ChangeNOW and 15,000 to FixedFloat — no-KYC swap services that make funds untraceable — when customer withdrawals go to customer wallets? That is 33.8% of every XRP this treasury has ever sent, and ChangeNOW is the single largest recipient in its history.
• How much has XORA spent paying people to promote it, and how is that funded? We were offered $300; others on X report the same.
• Who is on the team that holds 15% of the token supply? Not one person is named on the site or in the whitepaper.
• Under which legal entity, in which jurisdiction, does XORA hold customer funds?
• Given that 211,278 XRP of customer money sits behind a single unrestricted key — no signer list, no regular key, no flags set — who holds that key, and what stops it being spent?
• Where is the "finite, disclosed treasury reserve" that pays the 15% yield? On-chain, 99.35% of everything the published treasury has ever received arrived as a customer deposit, and no reserve address has been disclosed.
• On what basis was 85.6986 units of a self-issued token called BTC announced as a "$5.5M treasury"? It has one holder, no order book, no AMM pool, has never traded, and cannot be held by anyone the issuer does not authorise.
• Where is the bitcoin? If the token represents real BTC held off-ledger, name the custodian and publish the addresses.
• Why was it minted twenty-two hours after XORA and its founder were asked in public about users who cannot withdraw — and why was that question never answered?
• The 29,899.8 XRP is in the treasury XORA controls. When will it be returned?

Nothing here requires trusting us. Open the main deposit transaction or the test payment on any XRPL explorer and read the destination, the tag and the delivered amount from the validated ledger. Compare the destination to the address on XORA's archived about page, and read the depositor's own account in his post on X. Every figure in this article was measured on 2026-08-03 from the public XRP Ledger and cross-checked against multiple independent full-history sources.

The 2026-08-05 additions are just as checkable. Open the 77.896 BTC mint and read the issuer, the amount and the currency code from the validated ledger; then open XORA's own announcement of it and compare. Look up the token on any explorer and count the holders, the offers and the pools.

This article documents publicly visible ledger activity, publicly made statements, and first-hand accounts from users who came to us directly. The advisory at the top is our own assessment on that evidence, offered so readers can make an informed decision; the factual record it rests on is set out above with hashes. If XORA disputes any fact here, publishes custodian addresses for the bitcoin it announced, or returns the funds, we will update the article.