XRPL Payment Drain Tracker
A live, on-chain record of the “Safe XRPL verify message” payment drain on the XRP Ledger. In a scam similar to the Xaman/XPMarket NFT phishing, victims are tricked into signing a Payment — not handing over a seed — that sweeps their XRP and tokens to attacker-controlled wallets. We flag the destination wallets the instant a drain lands, so wallets and dapps can block them before the next victim signs.
Don’t panic. Nothing leaves your wallet unless you sign — simply connecting, or the request spam by itself, cannot move your funds. If you’re not sure what to do, close the app or tab and ask for help before signing anything.
- Do not sign any “verification” transaction. No legitimate wallet check requires you to sign a Payment.
- Move remaining funds to a fresh wallet you create offline; assume the connected wallet is compromised.
- Revoke the malicious app’s access in your wallet (per-wallet steps are under each demo below) and never re-import your seed into a site.
- Check a counterparty before signing:
GET https://api.xrpl.to/v1/scams/check/<address>.
Attack flow at a glance
A fake "verification", airdrop, or poll on a Xaman / XPMarket lookalike.
Wallet connects so the site can scan balances. No funds move yet.
The prompt is really a Payment whose Destination is the attacker.
One signature sends the victim's XRP and tokens to the attacker.
Connecting is harmless on its own — the loss happens only at step 3, the instant a Payment is signed.
How victims get baited
The drain only works once you’re on the attacker’s page. Like the similar XRPL NFT offer-spam scam, it runs several lures in parallel — almost always wrapped in urgency (“verify in 10 minutes”, “limited slots”):
“Community Day Is Live. Monthly XRP Release. 10% Back to Holders.”
There is no “Community Day”, no “Monthly XRP Release”, and no “10% back to holders” program — none of this exists. It is just the current wrapper on the same sign-to-drain Payment.
- X / Twitter replies. Fake “Xaman support” / project-admin accounts, padded with bot followers, reply in trending XRPL threads with “verification” links.
- Brand impersonation. Mostly Xaman (“your wallet needs verification”, fake “Xaman Community Day”), plus spotlight tokens like PHNIX or FuzzyBear.
- Telegram & Discord DMs. A “support agent” or “moderator” DMs you after you post in a channel, then funnels you to the bait link.
- “Exclusive group” bait. An invite to a whale / OG-holders room gated behind a “membership verification” — the same sign-to-drain trap.
- Google search hijacking. Typo-squatted domains and paid “Sponsored” ad slots sitting above the real result for wallet / marketplace searches.
These lures mirror a similar scam’s playbook — full breakdown there: XRPL NFT Scam Tracker → How victims are lured in.
How the verification-sign drain works
It is a server-driven signature drainer: the attacker’s backend authors the transaction and the victim signs it in their own wallet on a lookalike like poll-xaman.app. The seed is never typed or collected — so the “never share your seed” warnings never fire.
What the victim actually signs — the friendly “Safe XRPL verify message” prompt at step 3 above — is a Payment whose Destination is the attacker’s wallet. There is no “verification” transaction type on the XRP Ledger; the word is purely cosmetic dressing on a transfer.
The takeaway: no legitimate wallet check ever asks you to sign a Payment. If a “verification” produces a transaction to sign, it is a drain.
Watch the drain — by wallet
Real recordings of the same drain across three wallets. Each shows the identical move: a friendly “verification” prompt that is actually a Payment to the attacker’s wallet.
What you’re watching
- Step 1
The site pushes a sign request into Xaman, framed as a routine “verification”.
- Step 2
The payload is actually a Payment whose
Destinationis the attacker’s wallet. - Step 3
Each approval drains one asset — the highest remaining balance by value first. Declining does nothing, so the attacker re-pushes the next-highest on a loop — the payment-request spam.
Recent drains (live)
Every confirmed drain, newest first — flagged the moment it lands on the ledger.
Drainer wallets
Every destination below is a confirmed drainer wallet on our free, published blocklist. Do not send to, or sign any offer/payment involving, these addresses.
Token sweeps
The drain isn’t XRP-only — it sweeps whatever the victim holds. Confirmed token sweeps:
| Token | Amount swept | Drains |
|---|---|---|
| XRPH | 23.21M | 2024 |
| RLUSD | 350 | 2023 |
| XRPHAI | 2.43M | 199 |
| USDT | 31 | 11 |
| HBAR | 7.85M | 1 |
| CSC | 43.8K | 1 |
| BEAR | 13.6K | 1 |
| BAYNANA | 5.0K | 1 |
| xPizza | 12 | 1 |
| PHNIX | 645.1K | 1 |
| DROP | 3 | 1 |
| ARK | 18.2K | 1 |
What gets flagged
Confirmed drainer wallets are added to a free, verified blocklist that wallets and marketplaces consume. We flag only the attacker’s receiving wallet — a victim who was tricked into signing is never listed.
Free API — block the drainers
No key required. The list is the union of every flagged XRPL address — payment drainers, NFT-phishing scam issuers, and other known scam wallets — so a single integration protects against all of them. Mirror it client-side and reject any Payment or offer to a flagged address before you sign.
curl https://api.xrpl.to/v1/scams/addressescurl https://api.xrpl.to/v1/scams/check/rNVdQM2AupHsZfGfkHKR4qfPHcLYwwbmH3Suggested integration: on app load, fetch /v1/scams/addresses once and cache the scamAddressesList; before submitting any Payment or accepting any offer, reject if the counterparty is in the set.
Data is on-chain and updates live as new drains are detected. Snapshot generated 0s ago. This page is informational; it is not financial or legal advice.