XRPL Foundation's Vet_X0 Warns XRP Holders of Bank-Name Scam Wave

Fraud Networks Copy Bank Brands

Fraud networks have begun stealing the names of established banks to strip XRP from unwary holders, and the alarm is now on public record. Vet_X0, a contributor to the XRP Ledger Foundation, published a public warning on X this week that describes the scheme in detail, and it names the mechanism before any cure. The trigger is not movement in the XRP price; it is Ripple's run of institutional wins, which criminals recycle as bait. Scammers generate vanity wallet addresses, strings engineered to resemble a bank's own branding, and mint dummy tokens imitating institutions named in recent announcements. As soon as a company announces its entry onto the XRP Ledger, the scam software produces a lookalike address within seconds, an address shaped like rBank paired with a token labeled after the same bank. The addresses are “beautiful” in the sense the warning uses: plausible at a glance, memorable, and close enough to the real thing that a hurried reader does not question them. Holders are then routed to phishing pages that ask them to verify their crypto wallet or to swap real XRP for the new bank tokens, and an entry in a blockchain explorer reads to an inattentive investor like proof of authenticity. Vet_X0 treats this as a change in tactics rather than an escalation of the old ones. Earlier XRPL incidents were technical: the summer Rippling-drainer botnet, counterfeit NFT collections, the September hack of the Bitget exchange that cost 103 million XRP, and the compromise of the XRPH Wallet, which drained roughly $452,000. The current wave requires no code exploit. It runs entirely on social engineering, borrowing the credibility Ripple has spent years building with regulated institutions, and it turns each genuine corporate headline into ammunition for theft. No victim totals for the spoofing wave itself accompany the warning; the loss figures on record belong to the earlier, technical incidents.

Cross River Bank and Evernorth Became the Bait

The material the scheme exploits is entirely genuine news. Cross River Bank has been testing Ripple's RLUSD stablecoin, Ripple's dollar-pegged token for institutional settlement, and the Evernorth treasury fund has pushed 473 million XRP through major exchanges as part of its deployment, so each fresh institutional headline hands the fraud networks new copy. That is the paradox at the center of the warning: the openness of the ledger now works against security, because anyone can issue a token under any name on the XRP Ledger, and the explorer record proves only that a token technically exists, never who stands behind it. Institutional behavior, the post argues, is the tell. Large banks operate through internal gateways, and the checks that govern a customer relationship, from identity verification to redemption at the issuing institution, never reach a retail holder's token balance. A message that asks a holder for any action around a bank-branded token is therefore, by construction, not from the bank. Requests that extract a seed phrase or a transaction approval surrender the account completely, and moving keys into custody the holder controls, such as the offline storage described in a Ripple (XRP) paper wallet, removes the phishing surface altogether. “Just sit on your hands and do nothing,” is the post's instruction to retail holders facing any such prompt. The only confirmation that a real bank stands behind a project, Vet_X0 concludes, is a publication on that corporation's own official press site. Every other offer, the post states, is a guaranteed loss of capital.

A Warning on Record, Not an Enforcement Action

The record stops at a warning, not at an enforcement action, and that distinction defines the risk for now. No regulator or exchange has moved against the copycat tokens, no victim totals for the spoofing wave have been disclosed, and the only countermeasure on file is behavioral: do nothing when prompted. Protocol hygiene is scheduled separately, with the XRP Ledger's fixCleanup3_4_0 security fix locked for October 23 activation, but no code change can veto a holder's own signature. In our reading, the attack surface has moved from the ledger to the news cycle: each legitimate Ripple ecosystem announcement now manufactures a counterfeit of itself within seconds, leaving the corporation's own press site as the single load-bearing verification channel. An explorer entry or a swap offer substitutes for nothing.