XRP Scams: Vet Flags 11.5M Posts Targeting Holders

Hussein Zangana, the XRP▼$1.06 Ledger Foundation’s community director known as Vet, said an analysis using X’s API found about 11.5 million XRP scams in posts targeting XRP users with fraudulent reward and airdrop promises over the preceding 30 days. U.Today published the finding on November 11, 2026.

The posts dangle free tokens and exclusive rewards before directing users to malicious websites, harmful transaction requests and prompts for sensitive wallet information. Uphold, Ripple and RippleX have previously warned about related impersonation schemes involving bogus software downloads and fake livestreams.

📖Vet Flags About 11.5 Million XRP Scam Posts
⚠️The People and Organizations Behind the XRP Warnings
✨Uphold and Ripple Had Already Flagged Impersonation
🎁How XRP Reward Offers Lead to Wallet Risks
🎯The Scale of the XRP Post Campaign
🟢Requests XRP Holders Should Treat as Red Flags
👥Where XRP Users Were Told to Verify and Report Claims
❓FAQ

Vet Flags About 11.5 Million XRP Scam Posts

What Did the X API Analysis Identify?

Vet said his analytics focused on posts aimed specifically at the XRP community through reward and airdrop promises. About 11.5 million posts appeared over 30 days, or roughly 383,000 posts a day on average.

The pitch is straightforward: offer something valuable, such as free tokens or access to an exclusive distribution, then push the user toward a wallet or private-information request.

What Did Vet Say in His Announcement?

“In the last 30 days about 11.5 million (!!) posts were made targeting specifically the XRP community to scam them with reward and airdrop promises,” Vet wrote. He said the finding followed analytics conducted with X’s API.

Doing some X analytics with their API.

In the last 30 days about 11.5 million (!!) posts were made targeting specifically the XRP community to scam them with reward and airdrop promises.
— Vet (@Vet_X0) November 10, 2026

Doing some X analytics with their API.

In the last 30 days about 11.5 million (!!) posts were made targeting specifically the XRP community to scam them with reward and airdrop promises.

The article carrying his statement was published at 10:30 UTC on November 11. Vet’s observation covered the preceding 30 days, a sustained stream of offers aimed at the community.

The People and Organizations Behind the XRP Warnings

Who Presented the Finding?

Zangana posts on X as @Vet_X0 and serves as the XRP Ledger Foundation’s director of community. He attributed the post count to analytics he conducted using the platform’s API.

His targets were XRP community members receiving reward and airdrop solicitations. The danger lies in what the messages seek next: a wallet connection, transaction authorization or disclosure of sensitive information.

Which Organizations Have Issued Related Alerts?

Uphold’s Head of Research, Dr. Martin Hiesboeck, previously warned customers about a phishing message asking them to install a desktop application. Ripple and RippleX separately addressed impersonation involving their names, staff and XRP.

Each warning described requests that holders should reject. Uphold rejected the application download, while Ripple and RippleX cautioned users against requests for funds or wallet information made in the company’s name.

Earlier alerts covered several channels, from direct messages to public video content. In each case, the scammer invoked an apparently trusted identity to prompt a specific action.

Uphold and Ripple Had Already Flagged Impersonation

What Was the Bogus Uphold Application Request?

In an earlier warning, Hiesboeck said Uphold had become aware of phishing messages asking users to download a new desktop application. He rejected the request as illegitimate and urged recipients to proceed cautiously.

The message combined an exchange identity with a software request, rather than the reward pitch highlighted by Vet. Hiesboeck advised users not to click links or download attachments and to send suspicious communications to Uphold’s official support.

For customers, the installation request was the warning sign. Uphold had already rejected that instruction, giving recipients a clear reason to stop before following a link or opening an attachment.

What Did Ripple Observe Around Swell?

Ripple said it had observed a surge in fake “Live” YouTube videos during and after its Swell event. The company urged the XRP community to stay vigilant and said neither Ripple nor its employees would ask users to send XRP.

RippleX also warned about fake Ripple or XRP livestreams, giveaways and deepfake videos. That warning covered requests to send funds, share wallet information or join investment streams.

The schemes reach well beyond one social platform. A holder might see a public giveaway pitch in a video or receive a direct message that appears to come from an exchange or company employee.

How XRP Reward Offers Lead to Wallet Risks

What Actions Are the Offers Intended to Trigger?

The warning centers on attempts to lure users into connecting wallets to malicious websites, signing harmful transactions or revealing sensitive wallet information. The advertised reward supplies the reason to engage.

A promise of free tokens can lead to a request involving assets the user already holds. The moment of risk arrives when the offer asks a holder to use a wallet, approve a transaction or provide information in pursuit of the advertised benefit.

Vet singled out reward and airdrop pitches as XRP airdrop scams. Those are the offers to recognize in the current warning, together with the wallet actions attached to them.

How Does Impersonation Strengthen the Pitch?

Ripple’s earlier warnings covered fake livestreams, giveaways and deepfake videos using familiar company or XRP identities. The Uphold alert involved a message presented as an instruction tied to a platform its recipients use.

A recognizable identity gives the user a reason to consider the request. Ripple was explicit: its employees would never ask people to send funds, share wallet information or participate in investment streams.

That warning offers a practical test for messages carrying a familiar name. A demand for XRP or sensitive wallet information conflicts with what Ripple and RippleX told the community to expect from employees.

The Scale of the XRP Post Campaign

How Large Is the Daily Average?

About 11.5 million posts spread across 30 days amount to roughly 383,000 posts a day. That is the volume of reward and airdrop solicitations Vet described during the full observation window.

The posts targeted XRP community members specifically. For holders following XRP discussions on X, the scale raises the odds of encountering reward messaging built to provoke an unsafe response.

Which Offers Were Included in Vet’s Description?

Vet identified reward and airdrop promises. His account described free tokens, rewards and exclusive airdrop opportunities as the bait used to entice users.

The warning becomes easier to apply when the sequence is clear: a promised benefit comes first, followed by a request for a website visit, wallet connection, transaction signature or sensitive information.

Earlier warnings supplied other examples to treat cautiously, including a supposed new Uphold application, a fake Ripple livestream, a giveaway or a video impersonating a trusted figure.

Requests XRP Holders Should Treat as Red Flags

Which Requests Conflict With Ripple’s Warnings?

Ripple told users that neither the company nor its employees would ask them to send XRP. RippleX also rejected employee requests for funds, wallet information or participation in investment streams.

A giveaway offer that asks the recipient to send funds directly contradicts that guidance. So does a supposed employee request for wallet information tied to a reward.

RippleX specifically identified fake livestreams and deepfake videos. Its warning covered both the identity behind a request and the action requested from a holder.

Which Download Requests Did Uphold Reject?

Hiesboeck’s warning concerned a purported new desktop application. He said the download request was illegitimate and cautioned customers about suspicious communications carrying that instruction.

Uphold gave users a clear response: avoid suspicious links, do not download attachments and report the message through official support. That guidance applies to the email or message before anyone follows an installation request.

The application alert and the reward-post warning use different prompts. Both place an unsolicited message at a decision point, asking for action involving software, funds or wallet access.

Where XRP Users Were Told to Verify and Report Claims

What Should Uphold Users Do With Suspicious Messages?

Uphold directed recipients to its official support after receiving suspicious emails or messages. Hiesboeck paired that reporting route with a warning against clicking links or downloading attachments.

Users can raise the issue with the platform named in the message. In the desktop application case, Uphold had already rejected the requested download as illegitimate.

Where Did RippleX Direct Holders to Check Claims?

RippleX urged users who were in doubt to verify information through Ripple and RippleXDev while safeguarding their XRP. The warning covered fake streams, giveaways and deepfake videos.

That guidance applies directly to the reward offers described by Vet: check claims through the named official channels, and treat requests for funds or wallet information as inconsistent with Ripple’s warnings about employee conduct.

The key is the action attached to the offer. A promised airdrop may lead to a wallet interaction; an apparent exchange message may lead to a download. Those are the points where holders should stop and verify the claim.

FAQ

Who Is Vet, the Person Who Reported the XRP Scam-Post Figure?

Vet is Hussein Zangana, the XRP Ledger Foundation’s director of community, who uses the X account @Vet_X0. He said he used X’s API to analyze posts aimed at XRP community members.

When Did U.Today Publish the Article About Vet’s Analysis?

The article appeared on November 11, 2026, at 10:30:16 UTC. Vet’s statement described activity across the preceding 30 days.

What Does the 11.5 Million Figure Count?

It is Vet’s approximate total for posts identified as targeting XRP users with fraudulent reward and airdrop promises. The offers use the prospect of a benefit to draw users into a further interaction.

What Did the Bogus Uphold Message Ask Users to Download?

The phishing message asked recipients to install a new desktop application. Uphold research chief Dr. Martin Hiesboeck rejected the request and cautioned users about communications promoting it.

What Fake YouTube Content Did Ripple Flag Around Swell?

Ripple flagged an increase in fake “Live” YouTube videos during and after Swell. Its accompanying warning emphasized that the company and its employees would never ask users to send XRP.

Where Did Uphold Tell Users to Report Suspicious Messages?

Customers were directed to Uphold’s official support. The warning also instructed them to leave suspicious links and attachments unopened.

Which Channels Did RippleX Recommend for Checking Claims?

RippleX pointed users to Ripple and RippleXDev for verification. It named fake livestreams, giveaways and deepfake videos among the threats holders should watch for.

This article is for information only and is not financial advice.