A phishing scheme that operated under the guise of a legitimate staking platform last October resulted in 3.4 million XRP being stolen from 71 investors, with total losses valued at 12.3 billion won ($8.5 million), according to the Seoul Metropolitan Police Agency.
Fake staking platform mimics Flare Network
Police reported that the fraudulent site, Fxrpntwork.com, presented itself as an official platform associated with Flare Network and its FXRP token. Flare Network is a blockchain project focused on expanding interoperability across various networks, and FXRP is one of its tokenized assets designed to bring non-native tokens onto its platform.
The operators, both 29 years old, allegedly told investors the project would provide monthly returns between 1.5% and 1.8%, guaranteeing principal safety. Investors were directed to transfer their XRP holdings from domestic exchanges, routing funds through overseas venues before finally depositing into wallets controlled by the fraudulent group. The scheme, which coincided with the real FXRP launch the previous month, abruptly ended on October 23 when the platform was shut down and operators vanished.
Mini dictionary: Flare Network, an EVM-based blockchain for smart contracts, aims to enable blockchain interoperability and supports the use of non-native assets on its network. FXRP is a protocol that lets users bring XRP to the Flare blockchain for staking and DeFi activities.
Deceptive tactics and wider financial impact
To create the appearance of legitimacy, the suspects allegedly seeded online news articles, portal blogs, and even Wikipedia entries with misleading information about the staking site. They also produced YouTube videos featuring a paid stand-in to assure users of authenticity. The stand-in, aged 34, now faces separate fraud charges.
Authorities put the average loss at 173 million won ($119,000) per affected investor, incurred during the single week the site was online.
Police emphasized that “the fraudulent group manipulated online content and social media, so anyone seeking to verify the project encountered what appeared to be independent endorsements.”
Investigation and asset recovery
In their investigation, law enforcement traced a total of 27.3 billion won ($18.8 million) moving through digital wallets tied to the suspects. Of that amount, 17.3 billion won in assets were frozen across overseas exchanges immediately after detecting fraudulent activity. Another 10 billion won was moved during the investigation and has yet to be recovered, with police noting this suggests more victims may exist beyond the 71 currently identified.
| Metric | Amount (KRW) | Amount (USD equiv.) |
|---|---|---|
| Losses by 71 victims | 12.3 billion | $8.5 million |
| Total traced | 27.3 billion | $18.8 million |
| Assets frozen | 17.3 billion | $13 million |
The crackdown was initiated after an overseas exchange tipped off South Korean police about a spike in staking fraud last October. Authorities carried out 54 search and seizure operations, apprehending one suspect at a domestic hideout upon his return from abroad, before arresting the others in succession. A fourth suspect, also aged 29, remains at large overseas under an Interpol Red Notice.
Investigators indicated, “Given the scale of funds tracked compared to confirmed losses, the number of actual victims may be higher than currently known.”
Continued anti-fraud measures in South Korean crypto sector
None of the four suspects have been tried, and police have not disclosed their names. This operation is one of several recent law enforcement actions targeting cryptocurrency-related crimes in South Korea. In June, authorities charged 23 individuals involved in laundering $11.1 million in USDT tied to a Cambodia-based phishing network.
Officers stated their intention to pursue crypto-related fraud with “zero tolerance” and encouraged investors to consult official sources before transferring digital assets to staking platforms or any third-party services.
