XRPL fraud & scam intelligence 🔎 On-chain investigations • Address attribution • Scam alerts Making the XRP Ledger safer.
XRPL
Joined September 2026
- Tweets36
- Following64
- Followers77
- Likes67
XRPL Intel is now live 🌐 xrplintel.org
Our API provides identity information, scam & spam lists, and address tags for the XRP Ledger. DM us for access.
Help us spread the word — follow, repost, and support a safer XRPL. 🔎
#XRPL users: device security is wallet security. 🔐
Avoid untrusted apps and keep your software up to date.
Binance is applying enhanced compliance measures following FinCEN’s designation of MEXC as a Primary Money Laundering Concern.
Effective immediately, users should not send funds to, receive funds from, or otherwise transact through Binance involving MEXC, MEXC Global, MEXC affiliates or related entities. Requests to send funds to MEXC addresses will be rejected.
Any direct or indirect transaction involving these entities will be subject to further review. Impacted funds and accounts may be temporarily restricted while the review is ongoing, and such activity may constitute a breach of Binance Terms of Use.
For questions, please contact Binance Support through official channels.
Binance case | XRP trail
118.66M XRP (~$139.07M) swapped via THORChain.
1,793.07 BTC paid out to 95 Bitcoin addresses, alongside payouts in ETH, USDC, and TRX.
Top 5 BTC destinations below 👇
As of 9 Nov, 17:11 UTC.
🤖 Made with AI
The 233M XRP stolen from Binance, worth approximately $291.5M, remains untouched in this account:
rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx
bithomp.com/account/rK21t6nG…
#XRP #Binance
Final Bitget investigation update:
Most stolen $XRP went through THORChain and was converted to BTC/ETH, ending up across 110 BTC and 8 ETH addresses.
We reported all traced wallets and findings to the Bitget investigation team.
8
189
This is what the flow of the stolen funds looks like now.
It all started with one wallet:
rwNhefsz1UQEusxhCvHip3RANinWi4CTck
We continue tracking the flows, and we report all findings to @bitget.
6
124
5 THORChain swap services are currently being used to move the stolen @bitget funds cross-chain.
Over 67.6M XRP (~$104.6M) has already been swapped through THORChain into BTC, ETH, and Base.
Most of it — 62.5M XRP (~$96.6M) — went into BTC swaps.
4
74
Almost half of Bitget’s stolen XRP funds have now moved from the original 5 wallets.
The stolen XRP is being laundered, mostly through @THORChain → moved cross-chain into BTC and ETH.
8
193
5.4M XRP has left one of the wallets and is now being laundered.
We’re seeing the same unidentified services used to move the funds as in the D’CENT case.
Some of the funds are also ending up at @Bridgersxyz . We’re tracking the flows.
5
56
The full picture of the 102.9M XRP stolen from Bitget.
Most of the funds are still sitting in the receiving wallets. Only one of the accounts has started moving its XRP.
We are investigating the case and tracking the funds.
⚠️ SCAM ALERT: Fake D’CENT emails claim your device “missed its update window.”
The link takes you to a page offering a “Slack” download for your OS.
DO NOT download or install it. It is not a legitimate D’CENT update.
Delete the email and stay safe.
Over 800K XRP has been stolen in the last 30 days through malicious NFT Buy offers pushed via fake airdrop websites.
Be careful. Always check exactly what you’re signing, and never blindly sign transactions pushed to your wallet.
D’CENT App users: check whether you are affected. If you are, move your funds to a newly created secure wallet as soon as possible.
One of the easiest and fastest options is @XamanWallet.
D’CENT Update — Sep 22, 03:15 UTC
• 7,059 potential victims
• 12.02M XRP received from potential victim addresses
• 1.44M XRP still held in tracked scam wallets
• 10.02M XRP sent to unidentified services/wallets
• 1.27M XRP sent to identified services
5
102
⚠️ WARNING: Fake D’CENT security emails are circulating.
Do NOT trust emails just because they mention the recent D’CENT incident.
Do not reply, click links, or share your recovery phrase. Always verify instructions through official D’CENT channels.
🚨 D’CENT Update — 20 Sep, 00:14 UTC
• 6,160 potential victim addresses
• 9.3M XRP collected from potential victims
The tracked funds are mixed with XRP received from other sources.
• 2M XRP still held in tracked wallets
• 7M XRP was sent to unidentified services
🧵 1/2
1
5
77
Two wallets have been identified where issued tokens stolen from D’CENT App users were collected:
rQKqEk7j1bKijfW8yiSjUMYqWVZMpUtgwY — holds RLUSD
r9NqRaFEM2Y73Cqq2sxCuzbBJCLDmZJREg — holds multiple XRPL-issued tokens
1/2
