Fake staking site drains $8.5M XRP

TLDR

A fake Flare-branded staking site in South Korea stole about $8.5 million in XRP from retail investors, with police warning the total scam size could approach $19 million.

1. A site called Fxrpntwork.com impersonated Flare Network and FXRP, luring 71 XRP holders with guaranteed 1.51.8% monthly returns and draining 3.4 million XRP.
2. Seoul police have arrested multiple suspects, frozen most of the traced funds, and say wallet flows tied to the scheme reach roughly $19 million in XRP.
3. The scam exploited trust and branding, not a protocol exploit, highlighting the need to verify official links and treat fixed-return staking offers with extreme caution.

Confidence: high based on multiple law-enforcement sourced reports.

Deep Dive

1. How The Scam Worked

According to Seoul police, a fake staking site at Fxrpntwork.com ran for eight days in October 2025 and stole 3.4 million XRP, worth about $8.5 million, from 71 investors by impersonating Flare Network and its FXRP token. Reports from Decrypt and Coindesk describe how the operators seeded blogs, online articles, Wikipedia entries, and YouTube videos to make the platform look like a legitimate Flare-based XRP staking service, promising principal guaranteed and fixed monthly returns of 1.51.8 percent. Investors were instructed to move XRP off domestic exchanges via overseas platforms into wallets controlled by the group before the site abruptly shut down and the organizers disappeared.

2. Law Enforcement Response And Scale

Police cyber investigators say they traced around 27.3 billion won in flows linked to the scheme, roughly $18.819 million in XRP, suggesting more funds moved through associated wallets than the $8.5 million reported by the initial 71 victims. Investigators froze about 17.3 billion won in crypto assets within days of the first complaint, and South Korean media report that at least two suspects are detained on aggravated fraud charges, while another is subject to an Interpol Red Notice and remains overseas. Authorities have executed dozens of search and seizure warrants and signaled a zero tolerance stance on similar crypto frauds, warning investors not to trust unverified staking or yield claims promoted on YouTube and blogs.

3. Protection For XRP And Other Holders

Crucially, this was not a hack of XRP Ledger or Flare smart contracts; it was an off-chain confidence trick using a convincing fake website and content. Common red flags included guaranteed monthly returns, principal protection promises, and instructions to move assets through specific exchanges and wallets. Before sending XRP (or any token) to a staking or yield platform, users should:

1. Check the projects official website and social channels, ideally via known directories, not search ads.
2. Confirm that any staking or lending product is documented by the genuine project team.
3. Treat fixed, guaranteed yields as a warning sign rather than an opportunity.

Conclusion

This case shows how scammers can weaponize familiar brands like Flare and XRP to run large phishing-style staking schemes without touching core protocols. For crypto users, the practical takeaway is that the biggest risk often comes from trusting the wrong website, not from on-chain exploits, and careful verification of any yield platform is essential before moving funds.