An unusual wave of unsolicited escrow transactions targeting users of the Xaman Wallet on the XRP Ledger has prompted urgent warnings from both the wallet provider and key community figures. The fraudulent activity came to light after Web3 consultant Stone received a report from another user and found two unexplained escrow-related transactions in his own wallet: one for creation and one for cancellation.
Details of the phishing technique
Stone sought clarification using the Xaman Wallet support xAPP, receiving an in-depth explanation from the support team. According to Xaman, scammers have begun sending unsolicited escrow transactions to a variety of wallet addresses. These transactions are crafted to appear as if they hold substantial amounts of tokens, in some cases presenting assets labeled as USDT0 or other fabricated tokens not supported by the real XRP Ledger.
The fraudsters intend to draw user attention to links embedded within the transaction details or memos. These links often direct unsuspecting users to external websites, which falsely claim they can assist in claiming or releasing the escrowed assets. Engaging with these sites can result in users authorizing harmful transactions that provide scammers with access to their funds.
The wallet provider urges users not to connect their wallets or approve any transaction requests generated by unknown third-party sites. These unauthorized operations are specifically designed to secure account-level permissions, which could subsequently compromise user assets.
Xaman stressed that simply receiving an unsolicited escrow transaction is not sufficient for scammers to steal funds. For fraud to succeed, users must actively authorize a malicious transaction, granting the attacker the ability to control balances or redirect assets. Unless a user takes such action, their wallet remains secure despite receiving suspicious escrow activity.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLPublic nature of the XRP Ledger and user limitations
The XRP Ledger’s decentralized and open structure means that any active wallet can send a transaction to another address without prior approval. As a result, users are unable to stop other parties from sending them transactions or to delete those entries from the ledger.
Xaman likened the process to receiving unwanted physical mail, where recipients cannot determine who sends messages to their address. Additionally, the technical team clarified that any fees associated with these unsolicited transactions are covered by the sender, not the recipient.
The support team’s response notes that users are not financially impacted by network fees in these cases, as those costs are paid entirely by the originator of the scam transaction.
Official guidance and next steps for users
To further mitigate risk, Xaman has flagged the scammer accounts in its blacklist database and is actively monitoring the situation. The company advises wallet holders to disregard unsolicited escrow transactions, refrain from clicking on suspicious links embedded in transaction metadata, and avoid signing or approving transactions without deliberate intent.
Stone publicly thanked Xaman for its detailed explanation and rapid action, sharing the company’s recommendations across the broader XRP Ledger community. This experience underscores the importance for wallet users to utilize official support channels when encountering unexpected on-chain activity and to avoid direct interaction with transactions that seem unfamiliar.
As the digital asset sector continues to evolve, parallel trends are emerging within traditional financial markets. While monitoring for phishing attempts and new token-based threats remains central for XRP holders, investors are also witnessing a significant transition as Wall Street moves its operations to Web3 infrastructure. Platforms such as 1stepSwap now allow digital asset holders to keep tokenized shares of major U.S. companies, as well as assets like gold and silver, directly in their crypto wallets. By automatically sourcing the best available market prices and removing traditional intermediaries, these solutions are redesigning the landscape for both conventional and crypto-native investors.
Xaman reiterates the need for ongoing vigilance, emphasizing that security depends on users not authorizing or initiating transactions for unrecognized assets or sources. For any unexpected or unclear wallet activity, consulting official support is strongly encouraged before taking action.
