Xaman Founder Warns of Daily Fake Accounts Pushing XRP Airdrop Scams
By Crypto Wire
October 22, 2026
Xaman founder Wietse Wind warned on October 22, 2026 that scammers are spinning up more than 20 fake X (Twitter) accounts and about 10 malicious domains each day to impersonate the XRP Ledger wallet — pushing a nonexistent desktop app and fraudulent XRP airdrops, TokenPost reported. Cloned sites that mimic xaman.app add fake governance badges and wallet-connect prompts meant to drain connected wallets. Wind also stressed that Xaman has no token after a compromised verified account promoted a fake XMN token. This is a Rug Room social-engineering chapter — impersonation and airdrop phishing, not a Xaman app breach and not a push-notification hijack like NGRAVE LIQUID.
Secondary desks and PhishDestroy same-day flags fill in the pattern: fake or hijacked “verified” profiles (some gold-badge accounts reportedly resold underground) point holders to airdrop / badge pages; a fake Ripple account pushed an “XRP Holder Tiers” claim that Ripple did not issue — neither Ripple nor the XRPL asks holders to register for badges or perks. Instagram and Telegram impersonations of Ripple executives appear in the same wraps. XRP analyst Zach Rector said community losses already run to millions of XRP and urged treating unsolicited social/email outreach as hostile. Desk rule for readers: never connect a wallet or enter a seed on airdrop pages reached from social DMs or lookalike domains.
Keep this file separate from QQL Tyler Hobbs mint impersonation and from SEAL’s fake white-hat Solana PoC advisory — those are different lure surfaces (NFT mint vs researcher-delivered malware kit). Today’s beat is retail XRPL wallet brand abuse at industrial daily volume.
For security desks, the cut is brand-velocity phishing: if an account offers an Xaman desktop app, an XMN/XAM airdrop, or Ripple “holder tiers,” treat it as a drain attempt until proven otherwise on official domains only.
What to watch on-chain next: Watch whether Wind or Xaman publish a dated official advisory URL list, whether PhishDestroy / URL scanners keep marking fresh Xaman lookalikes, and whether any large XRPL drain clusters get attributed to the airdrop lures — the desk cares about verified loss trails, not screenshot panic alone.
Bottom line: Wind says impersonators create 20+ fake X accounts and ~10 malicious domains daily against Xaman — fake desktop app, fake airdrops, no Xaman token.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The cryptocurrency and NFT markets are highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
