XRPL Foundation's Vet Counts 11.5M XRP Scam Posts in 30 Days

Roughly 11.5 million posts targeting XRP users with fraudulent reward and airdrop promises appeared on X over a 30-day window, according to an API-based analysis by Hussein Zangana, director of community at the XRP Ledger Foundation, who publishes under the handle @Vet_X0. U.Today reported the finding on November 11, 2026.

"In the last 30 days about 11.5 million (!!) posts were made targeting specifically the XRP community to scam them with reward and airdrop promises," Vet wrote on November 10. He attributed the count to analytics conducted through X's official API, not to estimates.

The volume translates to roughly 383,000 posts per day sustained across the full observation window — a continuous bombardment aimed at one holder community rather than a sporadic campaign.

What does the scale change for XRP holders?

For practitioners, the figure reframes exposure in operational terms. A holder following XRP discussion on X now faces a feed in which reward-and-airdrop solicitations are not occasional noise but a structural feature. The pitch follows a consistent sequence: a promised benefit first — free tokens, an exclusive distribution — then a request to visit a malicious website, connect a wallet, sign a harmful transaction, or disclose sensitive wallet information.

The moment of risk arrives when the offer asks a holder to use a wallet, approve a transaction, or hand over information in pursuit of the advertised benefit. A promise of free tokens can end in a request involving assets the user already holds.

Which organizations have flagged related schemes?

The campaign Vet measured fits a pattern that exchange and protocol operators had already documented:

• Uphold: Dr. Martin Hiesboeck, the exchange's head of research, warned customers about phishing messages asking them to download a purported new desktop application. He rejected the request as illegitimate and advised recipients not to click links, not to download attachments, and to forward suspicious communications to Uphold's official support.
• Ripple: The company reported a surge in fake "Live" YouTube videos during and after its Swell event, and stated that neither Ripple nor its employees would ever ask users to send XRP.
• RippleX: The developer arm warned about fake Ripple and XRP livestreams, giveaways, and deepfake videos, covering requests to send funds, share wallet information, or join investment streams. It directed users to verify claims through Ripple and RippleXDev channels.

How does impersonation strengthen the pitch?

Each warning describes a scammer invoking a trusted identity — an exchange, a company, an employee — to prompt one specific action. That identity supplies the reason to engage; the requested action supplies the harm.

Ripple's guidance yields a practical test that scales to the current post volume. A demand for XRP or wallet details directly contradicts what the company told the community to expect from genuine employees. A giveaway asking the recipient to send funds fails that test. So does a supposed staff request for wallet information tied to a reward. The Uphold case adds a second test: an unsolicited instruction to install software carrying an exchange's name.

The schemes span channels, from public video content to direct messages that appear to come from an exchange or a company employee, meaning verification must extend beyond a single platform.

Vet's count covers the 30 days preceding November 10, and the campaign shows no sign of abating. Holders should expect the verification burden — checking claims against Ripple, RippleXDev, and official exchange support — to remain a standing operational cost for as long as the volume persists.