Fake XRP staking scheme drains $8.5M

TLDR

A fake Flare Network XRP staking site in South Korea stole about $8.5 million in XRP from investors by promising easy, guaranteed yield.

1. The scam used a bogus site, Fxrpntwork.com, impersonating Flare and FXRP to siphon 3.4 million XRP from at least 71 victims.
2. Police say total flows linked to the scheme reach roughly $19 million, highlighting how yield and principal guaranteed claims are used to target XRP holders.
3. Crypto users should verify any staking or yield offer via official project channels and trusted exchanges, and treat unsolicited high return promises as a red flag.

Deep Dive

1. How The Scam Worked

Reports from Seoul police say Fxrpntwork.com ran for eight days in October 2025, presenting itself as a Flare Network staking platform for XRP and FXRP holders. It promised monthly returns of 1.5 to 1.8 percent with capital protection, encouraging users to move XRP off domestic exchanges via overseas platforms into wallets controlled by the group.

Investigators estimate that 3.4 million XRP, worth about $8.5 million, was stolen from 71 identified investors, with total traced flows around 27.3 billion won, or roughly $18.8 to $19 million, suggesting more victims than those initially identified according to police and multiple reports from outlets such as Decrypt and CoinDesk.

Two suspects have been detained on aggravated fraud charges and more are under investigation, with an Interpol Red Notice issued for an alleged ringleader who remains abroad.

2. Why This Targets XRP Holders

The scammers timed their site and branding around the legitimate launch of Flares FXRP token, using the projects name recognition within the XRP ecosystem to appear credible. They seeded Naver blogs, online news, Wikipedia entries, and YouTube videos to create the illusion of an official staking product, including claims that staking was exclusive to certain major exchanges.

This pattern fits a broader trend where impersonation scams piggyback on real network upgrades, token launches, or protocol features to trick users into thinking they are interacting with official infrastructure. XRPs large retail holder base and interest in passive yield made it a natural target.

3. Practical Safeguards For Staking And Yield

For any staking or yield offer, treat three checks as mandatory:

1. Confirm the exact URL and product from the projects official site or documentation, not from blogs, YouTube, or Wikipedia.
2. Use staking mechanisms integrated into well known exchanges or the projects own interfaces, and be wary of offers advertising fixed returns with principal guaranteed.
3. If a scheme asks you to move assets through multiple exchanges or obscure wallets to qualify, treat that as a high risk signal and step back.

Conclusion

This fake XRP staking scheme did not exploit a flaw in the XRP or Flare networks, it exploited trust and the desire for easy yield. As more lending and staking products launch on XRP and other chains, the key defense is disciplined verification of domains, products, and flows before moving funds, especially when returns sound unusually smooth or guaranteed.