Scammers Flood XRP Community With 11.5 Million Fake Airdrop Posts

Fake Reward Offers Flood X Users

Roughly 11.5 million posts promising fake rewards and airdrops targeted the XRP community over the past 30 days. Hussein Zangana, director of community at the XRP Ledger Foundation, who publishes under the handle Vet, ran the count through X's API and published it on November 10. In that post, he wrote that “about 11.5 million (!!) posts” had been created specifically to scam members of the XRP community with reward and airdrop promises. The 30-day window ends with his November 10 publication, so the figure describes a month of activity rather than a single day's burst.

The campaigns share one anatomy. A message announces a token giveaway, an exclusive reward program or early distribution access, then supplies a link and asks the recipient to connect a wallet to confirm eligibility. Once connected, the site requests a transaction signature or a seed phrase, and the funds leave with it. No on-chain exploit is involved at any point: the transfer is authorized by the holder himself. The payoff structure differs from an on-chain rug pull, where a project drains its own liquidity, because here the loss runs through the victim's own signature. Free tokens and rewards are the standard bait across the flagged sample, mirroring the language legitimate distribution campaigns use.

The figure covers posts the analysis identified as fraudulent, not organic airdrop chatter, and it counts messages aimed specifically at XRP users rather than crypto users in general. The count lands alongside renewed attention on XRP price action. Our XRP technical analysis page tracks the market's current levels as interest in the XRP ecosystem widens, and that widening audience is precisely the pool the scam posts are fishing in. The count comes from the ledger's own community apparatus rather than an external security vendor. For readers acquiring the token through legitimate channels, our Where & How To Buy XRP guide lists vetted venues.

Real-World Assets Cross $642 Million

The same stretch of calendar that produced the scam count also explains why XRP attracts it. Real-world assets are tokenized versions of off-chain instruments, fund shares in Franklin Templeton's case. On-chain data shows the XRP Ledger, a layer-1 blockchain protocol, holding $642.64 million in distributed real-world assets across 2,497 holders. Distributed RWA value grew 28.81% in the 30 days to November 6, 2026, up from $498.90 million a month earlier. Franklin Templeton is the largest distributed platform on the ledger, and its sgBENJI token accounts for all of the growth: the fund's balance on XRPL rose by about $144 million while every other distributed asset stayed flat. That concentration matters, because the ledger's tokenization growth currently rests on a single issuer's expansion rather than broad participation.

A separate $5.21 billion is recorded on the ledger as represented assets, a category the underlying RWA data tracks apart from the distributed figure, and that value slipped 0.38% over the window. The count of distributed-asset holders edged up 0.20%. In total, the blockchain carries 456 RWAs. Stablecoins add a second layer. The ledger holds $926.60 million in stablecoins across 75,840 holders, down 22.91% over 30 days, yet stablecoin transfers totaled $9.30 billion in the same window, up 63.56%. Value parked in stablecoins shrank while activity through them accelerated, so the ledger's payment rails stayed busy even as resting balances fell.

Each new Franklin Templeton share issued on XRPL and each additional holder added to the distributed tally widens the set of wallets the fake reward messages can land in front of. The adoption numbers and the scam numbers come from the same 30-day span, and they move in the same direction: the community the ledger is building is the audience the scammers are working.

The Promise Against the Delivery

The gap the operation lives in is the distance between the promise and the delivery. Every one of the 11.5 million posts offers a reward that does not exist; the only transaction that ever settles is the one that empties the victim's wallet. A count that large over 30 days also reads as automation rather than hand-typed messages, which is what the foundation's API analysis makes visible. As distributed asset value and holder counts on the ledger climb, the audience for the bait grows with them, and the promise stays the same even as the community it targets gets larger.