Uphold Moves 500 Million XRP Worth $649 Million to Five New Wallets

A Nine-Digit Ledger Move

On September 17, a wallet labeled Uphold (12) on the XRP Ledger paid out five transfers of exactly 100,000,000 XRP each — nearly $649 million combined — to five recipient addresses it had activated itself only hours earlier, on-chain records show. The five payments completed within a single 16-minute window, and the round-number sizing immediately drew commentary framing it as an institutional trading desk executing pre-arranged orders. The execution pattern looks scripted: the destinations were seeded with staggered activation deposits of 60, 70, 80, 90 and 100 XRP, applied in strict list order. Because an address on the XRP Ledger only comes into existence once another account funds it, the funding parent doubles as a permanent identifier — and that parent, Uphold (12), was itself activated in June 2025 by an older Uphold wallet. Ledger data shows Uphold (12) held about 1.47 billion XRP before the operation; after Thursday's payouts, its balance stood near 962.9 million XRP. Splitting a balance into five equal tranches also caps how much any single set of keys controls. As of 05:30 UTC on September 18, none of the five wallets had sent an outgoing payment — the only other activity was one address firing 0.00001 XRP “ping” payments to 109 wallets, a signature of dust-spam bots rather than custodial movement. It is the second nine-figure XRP transfer from Uphold in four days: on September 14, 145.6 million XRP left an Uphold (4) wallet for an address that had been activated in May. Crucially, none of the moves touched an order book: XRP (XRP) traded between $1.29 and $1.32 through the September 17 afternoon, holding its range even after the Senate blocked CLARITY Act cloture 49-50 and the Fed delivered its first rate hike since Q3 2023. The tokens merely changed custodial hands, leaving circulating supply untouched — though whether this is an internal cold-storage split or a major client withdrawal cannot be determined from the blockchain alone, and Uphold has not commented on either operation.

nearly $649 millionhttps://x.com/strivex_/status/2100690810119524482

Schwartz Joins the Phishing Fight

Hours before those ledger transfers drew the market's eye, Ripple CTO Emeritus David Schwartz was fighting a different battle on X — one aimed squarely at XRP holders' wallets. In the comments under the compromised account of culture magazine NplusOneMag, scammers had launched an aggressive promotional push for a fake airdrop impersonating the Xaman wallet, a popular self-custody option on the XRPL. Rather than routing the response through a corporate statement, Schwartz — one of the chief architects of the XRP Ledger — entered the scammers' thread personally and posted two blunt GIFs reading “I can spot a scam from a mile away” and “This is a scam,” as his own post shows. The intervention worked as a call to action: users flooded the platform's administration with reports, and the impersonating accounts were suspended before unsuspecting investors could lose funds. For Schwartz, this is routine guerrilla warfare — his profile has carried a pinned warning for months stating that anyone claiming to be him on Instagram or Telegram is a scammer. The raid fits a longer, systematic pattern of attacks on the XRPL retail layer. Scammers weaponize hidden trading offers through NFT spam campaigns: once a user approves a transaction while chasing a supposed bonus, the malicious transaction can drain their entire balance. These schemes run on engineered FOMO — manufactured urgency that pushes users to approve transactions they would reject on reflection. Basic defenses matter: self-custody backed by a Ledger recovery key, verifying every airdrop claim against official channels, and treating unsolicited promotion as hostile by default. The ledger's own activity underlines why the fight never stops — XRPL hub peers climbed back to 501 recently, a measure of live network participation. Scammers will keep spinning up mirror accounts, developers will keep getting them blocked, and the only variable is who moves faster during the next attack. Readers tracking the market in real time can follow live spot and futures prices on MEXC.

as his own post showshttps://x.com/JoelKatz/status/2100805777795809440?s=20

Taken together, the past 24 hours stress-tested XRP's ecosystem from both ends of the scale — institutional custody and retail security across the wider altcoin market — and our reading is that one property underwrites both stories: full ledger transparency. On-chain records, the primary source here, confirm the $649 million remains parked in wallets activated and funded by Uphold itself, while the primary record of the phishing raid, Schwartz's own post, shows senior-level response still anchoring retail defense. The trade-off cuts both ways: auditability lets anyone verify Uphold's balances in real time, but it equally lets attackers build convincing impersonations around real on-chain mechanics. Until exchange disclosures catch up with their own ledger footprints, both flows will keep being verified the hard way — publicly.