The Rippling-Drainer Botnet: Fake Same-Code Tokens That Silently Empty XRPL Wallets
An on-chain investigation into a 7-wallet cluster that mints worthless tokens whose currency code matches real assets — a fake RLUSD, a fake USDC, a fake XAH — then uses XRPL rippling to swap the genuine holdings out of any wallet that left rippling enabled. No victim signature. The wallets are funding-linked, and two of them were still draining the day this was published.
On-chain snapshot · measured 2026-07-06 · every figure reproducible from public ledger data
Tip: click any blue address or transaction hash to open it in an explorer.
Every trustline you create should have NoRipple set (tfSetNoRipple, flag 0x00020000). Modern wallets do this automatically. If you run a bot that creates trustlines, verify it sets that flag — the whole attack depends on finding wallets that didn't.
How the attack works
On the XRPL a token's identity is currency code + issuer. But rippling— the protocol's mechanism for moving IOU value across trustlines — matches only on the currency code. That gap is the exploit.
- You hold a real, valuable token — say
RLUSDfrom Ripple. - The attacker mints a worthless token with the same code
RLUSDfrom their own issuer. - You (or your bot) set a trustline to the fake — with rippling left ON.
- Now your wallet holds two "RLUSD"s, same code, rippling open on both lines. The protocol treats them as interchangeable at 1:1.
- The attacker sends a Payment that ripples through your account: the worthless RLUSD goes in, your real RLUSD comes out, at par. You sign nothing.
Attacker issues a worthless token with the SAME currency code as a real one — a fake RLUSD, USDC or XAH.
A snipe bot auto-sets a trustline to the fake — with rippling left ON (no tfSetNoRipple flag).
Attacker sends a Payment that ripples through the victim: fake token IN, real token OUT, at 1:1 par.
Victim keeps the worthless fake; the attacker walks off with the real asset. No victim signature required.
One Payment, initiated by the attacker. Value ripples through the victim at 1:1 — the victim signs nothing.
The defense is a single flag. Rippling can only pass through a trustline that does not have NoRippleset. Block it on either the real line or the fake line and the ripple can't complete. This is exactly why wallets set tfSetNoRipple on every trustline by default — and why the botnet only profits from wallets that skipped it. (For the full protocol mechanics, see What is an XRPL trustline.)
The cluster — seven wallets, one money trail
The seven wallets are tied together by their activation funding: each account's first-ever transaction is a Payment from another account in the group. The internal chain:
| Wallet | Created | Last active | Trustlines | Funded by | Role |
|---|---|---|---|---|---|
| rover | 2015-04-18 | 2026-06-29 | 337 | external (rUBf4Khm…) | Root · executes ripple-through drains |
| rapido5 | 2015-05-03 | 2026-07-06 | 1,206 | rover | Counterfeit mint · 36 fake tokens |
| rogue5 | 2015-06-10 | 2026-07-06 | 699 | rapido5 | Executes ripple-through drains |
| rammer | 2024-05-02 | 2026-06-25 | 1 | rogue5 | Relay / funder |
| rhubarb | 2024-11-27 | 2026-07-03 | 857 | rammer | Positions trustlines for drains |
| runner | 2024-07-28 | 2026-02-28 | 0 | external (rffGCKC7…) | Sub-branch (emptied) |
| royce | 2024-12-01 | 2026-02-27 | 0 | runner | Sub-branch (emptied) |
Three roots (rover, rapido5, rogue5) are dormant 2015 accounts re-activated in 2024 as attack tools; the rest were created in 2024. The vanity prefixes (rover, rogue, rapido, rammer, rhubarb, runner, royce) are a naming tell. Full addresses:
The counterfeit arsenal
One wallet — rapido5 — is the mint. It has issued 36 tokens whose currency codes clone real, recognisable XRPL assets. Each is worthless on its own; its only purpose is to share a code with something valuable so it can be rippled in as the genuine token is rippled out.
Impersonation targets include Ripple's RLUSD, Circle's USDC, Tether's USDT, Xahau's XAH, Evernode's EVR, plus popular meme/DeFi codes (BITx, FUZZY, PLX, ONDO, Horizon). rover separately minted DOGE, BABY, FAFO, USD and XDM; rhubarb minted ICE; rogue5 minted HIOU.
The drain in action
The most exposed targets are snipe bots: they auto-trust and buy new tokens at speed, and a common bug is creating those trustlines without tfSetNoRipple. In the first ~400 of rover's recent Payments alone, it rippled through 485 distinct counterparty wallets, cycling fake copies of USDC (×440), BITx (×342), XAH (×164) and RLUSD (×142). New victims typically get hit within a day of their bot going live.
The attack surface — wide exposure, narrow payout
This is not a historical curiosity. We sampled 50 of the most recently launched tokensand read the live rippling flag on every holder's trustline (from ledger state, snapshot 2026-07-06). The result:
A large share of holders on fresh launches leave rippling enabled — many are snipe bots whose TrustSet builder omits tfSetNoRipple. Several accounts set rippling-on lines across multiple tokens in a row, the signature of an automated tool with the bug baked in.
A high rippling-on rate is not the same as a lucrative target list. We traced 10 recent FirstLedger launches ledger-by-ledger (5,076 trustlines) and filtered the raw flag down to what an attacker can actually monetise:
- • 31% of trustlines were rippling-ON (the raw flag).
- • But the fastest snipers — the sophisticated bots — mostly set NoRipple correctly. Only the careless long tail is exposed.
- • The real target (fast auto-truster and rippling-on) was just 4.7% — 111 wallets.
- • Of those 111, only 6 held anything with a market price, and it was dust. Total realisable value across all of them: ~$21.
The two populations barely overlap: wallets holding real, liquid assets(RLUSD, USDC) are careful and set NoRipple; the wallets that leave rippling on hold worthless fresh memecoins. So harvesting new launches nets almost nothing. The botnet's actual profits come from a rare jackpot — the occasional wallet that both holds liquid value and left rippling on — found by sweeping the whole ledger cheaply, not by farming new launches. The exposure is real and worth fixing; the payout is concentrated in a handful of unlucky wallets, not the crowd.
How to protect yourself
- Use a wallet that sets NoRipple by default (all modern XRPL wallets do). Xaman, xrpl.to and others create every trustline with
tfSetNoRipple. - Never enable
asfDefaultRippleon your account. It flips every new trustline to rippling-on — the exact door this botnet walks through. - Bot operators: audit your
TrustSetbuilder. It must includeFlags: 0x00020000. One missing flag is the whole vulnerability. - Check existing lines: a trustline permits rippling when
lsfLowNoRipple/lsfHighNoRippleis not set on your side. Re-issue aTrustSetwithtfSetNoRippleto close it. - Be wary of duplicate-code holdings: if your wallet shows two tokens with the same ticker from different issuers, one may be a counterfeit planted to enable this swap.
Methodology & disclosure
Every figure here is measured from public XRP Ledger data (full-history nodes s1/s2.ripple.com) and the XRPL.to trade index, snapshot 2026-07-06. Wallet links are established by on-chain activation funding; token issuance and ripple-through Payments are read directly from transaction metadata. This is an analysis of publicly visible ledger behaviour to help users defend themselves — it does not assert the identity or intent of any individual. Addresses and hashes are included so anyone can independently reproduce the findings on any explorer.