Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
A large-scale yet technically primitive attack targeting XRP Ledger asset holders has erupted on social media platform X. XRPL full-stack developer, Andrew Spencer, exposed massive reporting notifications in which fake accounts tag users under posts about the launch of "Season 1" of a supposed 10 million Ripple USD (RLUSD) stablecoin distribution.
Scammers are disguising themselves as official organizations, including the Xaman wallet and the XRPL Foundation (XRPLF). However, community representatives have officially stated that no RLUSD airdrop exists - it is a scam.
Why blocking bots won't protect your crypto wallet anymore
The main feature of the current campaign is not the phishing itself, but the delivery method, as attackers have fully automated the process using networks of bots. They instantly generate new accounts, publish posts mentioning hundreds of real users, and disable comments from outsiders so nobody can post warnings.
Spencer complains that it is impossible to "unsubscribe" from these chains of mentions. XRPL community activists are expressing concern that standard client-side protection methods such as blocking accounts and hiding notifications only mask the problem for individual users, while the bot farms continue operating freely in the background.
The scheme exploits the high level of interest surrounding Ripple's real stablecoin RLUSD. Scammers follow the classic playbook, instilling victims with a false sense of urgency and FOMO, forcing them to visit phishing websites, connect their wallets such as Xaman, and sign malicious transactions, including activating hidden Trust Lines or wallet-drainer scripts.
Earlier, Ripple's David Schwartz had already urged the community to remain extremely vigilant. He emphasized that attackers are not inventing fundamentally new tools, but are instead relying on scale and intensity. The campaign includes both bot attacks on X and AI deepfakes impersonating Ripple executives on Telegram and TikTok.
Officials remind users that the real XRPL Foundation and Ripple never conduct sudden public token giveaways, never require wallet verification through third-party websites, and never ask for seed phrases. Any offer of "free" RLUSD on social media is a guaranteed scam.
Dan Burgin
