The “Verification Sign” NFT Drainer: One Operator, 528 Wallets, 200+ Exchange Tags

On the XRP Ledger a new wallet cannot exist until an older wallet funds it, and that funding payment is permanent and public — a birth certificate naming the parent. This operator exploits that with a strict linear chain: wallet → funds the next wallet with exactly 333.000000 XRP → that wallet mints ~100 phishing NFTs, drains victims, then funds the next and goes dormant. The 333-XRP edge repeats for 40+ generations, which is itself a unique, deliberate fingerprint.

Walking that chain upward ends at a treasury wallet, rD9sevUXkkqc5NFRJZAHQM4RbqmYYztF2f, which mints no NFTs at all — so it never appears among the scam NFTs themselves — yet it activated the wallets that seed the entire chain. Above it sit two thin pass-throughs and then the boundary: an exchange.

The activation chain terminates at rnJrjec2vrTJAAQUTMTjj7U6xdXrk9N4mT(“Kraken”), a custodial hot wallet holding ~44.3M XRP that has funded 35,417 accounts. That is an exchange, not part of the ring — which is exactly why it is the most useful lead: the withdrawal that first funded the operator's wallet originated from a KYC'd account at that venue.

An exchange hot wallet funds tens of thousands of ordinary users, so the exchange itself is not part of the operator's cluster. The first operator-controlled wallet below it is rsrroeS48Bezev1htMw16UhqrgRseXSb5h — the top of the cluster traced in this report.

Every drain below is a public on-chain settlement; click a hash to read it on any explorer.

Stolen XRP does not go straight to an exchange. It is consolidated into a few internal hubs, then routed through near-zero-balance pass-through forwarders (layering), and only then deposited to exchange wallets under destination tags. The forwarders are operator infrastructure funded outside the minting chain — which is why they converge on the very same exchange tags, confirming one operator.

On an exchange, a destination tagroutes a deposit to a specific customer account. The operator's cash-outs carry 200+ distinct tags across 16 deposit wallets. Same deposit wallet + tag fed by multiple operator wallets = one beneficiary; and the tag format fingerprints the venue — e.g. rwXnv8… and rNxp4h8… share a 2097xxxxxx scheme, so they are deposit addresses at the same exchange — Binance.

Endpoints are now being attributed. rNxp4h8apvRis6mJf9Sh8C6iRxfrDWN7AV is a Binance deposit wallet — a major regulated exchange and the cleanest freeze/KYC target. rwXnv8BfEHi7WmkLXZ6ChcWX9hMnSsTMNK, which shares Binance's 2097xxxxxx tag-scheme, has also been flagged as an exchange deposit on X (1, 2). Two more — rJzNqvafEN6mPXykTTWz7f2Xfz5uXHAsRF and rQrqppDZMMKeq1x9gDuoytWeRLmLfXYV3q — tie to unionchain.ai, a swap service Bithomp flags as a scam (rJzNqvaf was activated by it; rQrqppD is labelled unionchain.ai — Bithomp). But the single largest off-ramp by volume, rwxvzhydd8uK3wYBFSjzVKzzTDM4cdFwDc, is linked to the CFBIT wallet scam (cfbit.org) — itself tied to a reported ~$3M XRP theft by CFBIT-linked actors — so much of the stolen XRP was funnelled from one scam straight into another rather than into a regulated venue (report, $3M case, discussion). CFBIT looks like an instant-swap app, and its destination tags are low and tightly clustered (1264, 1272, 1284…) — consistent with a small rotating pool of temporary tagsrather than per-user IDs, so unlike the regulated exchanges above these tags likely don't pin a single persistent account.

The cash-out splits two ways. Half lands at regulated, KYC'd exchanges — Binance, HTX, Crypto.com, Bybit and Bitget — where deposits can be frozen and traced to a customer; the other half goes through no-KYC / scam swap services— FixedFloat, SimpleSwap, ChangeNOW, unionchain.ai and CFBIT — chosen to break the trail. The regulated half is the actionable one: the (wallet, destination-tag) pairs in the table are exactly what those exchanges' compliance teams need to identify and freeze the accounts.

Note: some exchanges issue a unique tag per depositrather than per account, so a wallet's tag count is an upper bound on accounts. The exchange's compliance team can map each tag to its customer; the reqTag wallets (e.g. rffGCKC7Mk4cQ5aUGg8pfRe3MPC7Cy8gfe, rNxp4h8apvRis6mJf9Sh8C6iRxfrDWN7AV) are the cleanest hand-off.

1. Open the active wallet rhQ63weALNzu5tLmS58pN2h8RUX18WQEe7 and read its activation parent → rhuTqhU89XNAR8sDTqvcVhNco6siqii6cM, funded with 333 XRP.
2. Walk the parent links upward: each is funded with exactly 333 XRP, back through the treasury rD9sevUXkkqc5NFRJZAHQM4RbqmYYztF2f to the anchor rsrroeS48Bezev1htMw16UhqrgRseXSb5h, whose parent is the exchange rnJrjec2vrTJAAQUTMTjj7U6xdXrk9N4mT.
3. On any operator wallet, filter outgoing Payments and read the destination address + tag → they land on the deposit wallets in section 6.
4. Cross-check a tag scheme (e.g. 2097xxxxxx) across two deposit wallets to confirm they are the same venue.

Tools: any XRPL explorer, a full-history node (s1/s2.ripple.com), or the XRPL.to address and transaction pages linked above.