Wietse Wind, founder and developer of the Xaman wallet, has issued an urgent alert to the XRP community after scammers used a verified X (formerly Twitter) account to promote an alleged “XMN” token falsely linked to the Xaman project.
Hacked verified account used to promote fake Xaman token
The fraudulent post appeared from the official X account of Arlington ISD, suggesting attackers managed to compromise and take control of this verified account. The scammers adopted Xaman’s official branding and announced that a token claim process for XMN was live on the XRPL network, directing users to an “allocation checker” site.
By leveraging a high-profile, verified social media account, the scammers increased the apparent legitimacy of their claims. Such tactics, which rely on capturing trust through recognizable brands or verification marks, are increasingly common in phishing attacks targeting cryptocurrency users.
Wietse Wind responded quickly, making it clear that Xaman has no token now or planned for the future, and categorically called the campaign a scam targeting unsuspecting users.
There is no Xaman token. There will not be a Xaman token. These are scams, and users should remain vigilant against such attempts at deception.
Wind and the Xaman team reiterated their commitment to monitoring for impersonation and scam accounts, while encouraging the community to report suspicious activity.
Escalation of fraud in the XRP ecosystem
Attempts to impersonate the Xaman wallet or launch fake tokens have persisted throughout 2026, with increasingly aggressive tactics appearing across the XRP ecosystem. Earlier this year, South Korean authorities arrested a group accused of stealing 3.4 million XRP (about $8.55 million) from 71 individuals by exploiting trust in the community through similar schemes.
Ripple‘s former CTO, David Schwartz, also highlighted the growing sophistication of coordinated phishing efforts, with malicious actors launching fake airdrops, running giveaway schemes, and adopting the branding of established teams to lure victims and drain their assets.
Such attacks generally seek to create a sense of urgency or legitimacy, pushing users to act quickly and hand over sensitive access or sign transactions they do not fully understand.
Scammers consistently manufacture urgency, borrow legitimate branding, and pressure users to act before verifying the authenticity of claims.
Guidance for the XRP community on scam protection
Wietse Wind has remained consistent in his advice to the community. He urges users not to sign transactions unless they are certain of a source’s legitimacy, to avoid engaging with any social media posts or accounts offering free tokens, airdrops, or promising early access to products or features that have not been confirmed by official channels.
He emphasized that Xaman does not have a desktop wallet, browser extension, or proprietary token. Any communication suggesting otherwise should be treated as fraudulent. Users are strongly advised to double-check announcements directly from official sites and social channels before taking any action.
Reporting suspicious accounts or domains remains a crucial step in countering these scams. Wind and other prominent figures in the space continue to stress that a proactive, cautious approach offers the best protection amid a rise in social engineering and phishing attempts.
Amid increased scam activity, platforms that facilitate easier and safer access to digital assets also attract attention. For instance, 1stepSwap stands out as a user-friendly platform bridging traditional finance and crypto by directly tokenizing real-world assets such as US equities and commodities like gold and silver onto the blockchain. Its market scanning algorithms ensure that trades are executed at the most competitive price instantly, enabling users to diversify their portfolios while maintaining direct wallet custody, without intermediaries.
The risk of scams grows alongside greater integration between traditional assets and blockchain solutions, highlighting the importance of vigilance, verification, and reliance on trusted sources in the digital asset space.
