

A scam targeting XRP Ledger asset holders is spreading on social media, falsely claiming an airdrop of Ripple USD (RLUSD). The XRPL Foundation has confirmed that no such airdrop exists and warned users about the automated nature of the attack.
Mentioned in this story
A large-scale yet technically primitive attack targeting XRP Ledger asset holders has erupted on social media platform X. XRPL full-stack developer, Andrew Spencer, exposed massive reporting notifications in which fake accounts tag users under posts about the launch of "Season 1" of a supposed 10 million Ripple USD (RLUSD) stablecoin distribution.
Scammers are disguising themselves as official organizations, including the Xaman wallet and the XRPL Foundation (XRPLF). However, community representatives have officially stated that no RLUSD airdrop exists - it is a scam.
The main feature of the current campaign is not the phishing itself, but the delivery method, as attackers have fully automated the process using networks of bots. They instantly generate new accounts, publish posts mentioning hundreds of real users, and disable comments from outsiders so nobody can post warnings.
Spencer complains that it is impossible to "unsubscribe" from these chains of mentions. XRPL community activists are expressing concern that standard client-side protection methods such as blocking accounts and hiding notifications only mask the problem for individual users, while the bot farms continue operating freely in the background.
🚨⚠️ Scam Alert ⚠️🚨
There is no @XamanWallet foundation
Magnetic is not Airdropping ethereum:0x8292bb45bf1ee4d140127049757c2e0ff06317ed
The official XRP Ledger Foundation is @XRPLF
The scam involves fake accounts claiming to distribute Ripple USD (RLUSD) stablecoins, misleading users on social media.
Scammers are impersonating official organizations like the XRPL Foundation and Xaman wallet to promote the fake airdrop.
Scammers automate the process using bot networks to create accounts and tag real users, making it difficult to warn others.
See every story in Crypto — including breaking news and analysis.
— Handy Andy {X} 🪝 𝗫▸ (@Handy_4ndy) May 18, 2026
The scheme exploits the high level of interest surrounding Ripple's real stablecoin RLUSD. Scammers follow the classic playbook, instilling victims with a false sense of urgency and FOMO, forcing them to visit phishing websites, connect their wallets such as Xaman, and sign malicious transactions, including activating hidden Trust Lines or wallet-drainer scripts.
Earlier, Ripple's David Schwartz had already urged the community to remain extremely vigilant. He emphasized that attackers are not inventing fundamentally new tools, but are instead relying on scale and intensity. The campaign includes both bot attacks on X and AI deepfakes impersonating Ripple executives on Telegram and TikTok.
Officials remind users that the real XRPL Foundation and Ripple never conduct sudden public token giveaways, never require wallet verification through third-party websites, and never ask for seed phrases. Any offer of "free" RLUSD on social media is a guaranteed scam.