XRP users are facing a fresh wave of sophisticated phishing attacks, with Xaman Wallet founder Wietse Wind urgently warning the community about fake desktop applications and fraudulent airdrops. According to Wind, more than 20 scam X (Twitter) accounts and over 10 fake domains are created daily, all impersonating Xaman Wallet to deceive holders into connecting wallets or approving malicious transactions.
Wind made clear that there is no official Xaman desktop wallet and no XRP airdrop. The scammers use copied branding and promising free tokens to trick users into signing away access. Once a malicious approval is granted, attackers can instantly drain wallet balances – a risk that cannot be reversed on-chain. The warning comes shortly after Ripple CTO David Schwartz also cautioned XRPL community members about a sharp increase in fake giveaways and impersonation accounts.
The Xaman team is actively reporting fake accounts and domains, but new ones continue to appear. Wind urged users to remain vigilant: “Stay vigilant! There is no desktop wallet! No airdrop!” He added that the team has built filters and warning systems into the wallet ecosystem, but user awareness remains the strongest defense. The campaign highlights a broader 2026 trend of scammers targeting high-activity crypto communities as adoption rises. For XRP investors, the financial and psychological impact is real, as even legitimate XRPL tools may be avoided out of fear.
