Scam Details and How It Unfolded

Wietse Wind, founder of the Xaman wallet, has issued a clear warning to the XRP community about a coordinated scam promoting a fake token called XMN. Attackers took control of a verified X account associated with Arlington ISD and used official Xaman branding and imagery to claim that a token allocation process was underway on the XRPL network.

The fraudulent posts directed users to a fabricated allocation checker website. By operating through a verified account, the scammers aimed to create an appearance of legitimacy and pressure recipients into interacting with the site or signing transactions.

Wind responded promptly, stating that Xaman has never issued a token and has no plans to do so. He described the activity as fraudulent and called on users to stay alert.

Broader Pattern of Fraud Targeting XRP Holders

The incident fits into a wider pattern of impersonation and phishing campaigns directed at the XRP ecosystem throughout 2026. Earlier this year, South Korean authorities arrested suspects linked to a scheme that allegedly defrauded 71 individuals of 3.4 million XRP, valued at roughly $8.55 million at the time.

David Schwartz, former chief technology officer at Ripple, has pointed to the increasing sophistication of these operations. Scammers frequently create fake airdrops, giveaways, and urgent claims while borrowing branding from established projects.

These tactics exploit trust and encourage rushed decisions that can lead to the loss of funds or private keys.

Advice for Users and Official Clarifications

Wind has stressed several points for protection. Xaman does not offer a desktop wallet, browser extension, or any proprietary token. Any message suggesting otherwise should be treated as suspicious. Users are advised to avoid signing transactions unless the source is fully verified through official channels and to ignore social media posts promising free tokens, airdrops, or early access that have not been confirmed by the project team.

He recommends checking announcements directly on official websites and social accounts, reporting suspicious profiles or domains, and remaining skeptical of unverified promotions. The Xaman team continues to monitor for impersonation attempts and encourages the community to do the same.

Community members are urged to rely on established communication channels and to treat unexpected claims of token distributions with caution. As phishing methods grow more refined, careful verification remains the primary defense against asset loss.