Phishing attempts targeting XRP users are spreading, prompting related projects and wallet services to issue warnings.

On Aug. 3, blockchain media outlet U.Today reported that Xora Finance warned its community in a post on X that fake sites mimicking XRP-related brands such as Flare Network and Xora were spreading.

Xora Finance founder Joren Lundgren (요렌 룬드그렌) shared the matter and said a South Korean fraud group was targeting the XRP community. He said a highly sophisticated operation was under way. Xora Finance advised users to avoid ad links and direct-message links and to use only official addresses.

A case of actual 피해 also emerged. Seoul police said last month that a fake Flare Network staking site stole 3.4 million XRP from 71 investors. The losses were put at about $8.5 million.

Security warnings aimed at XRP holders were not limited to one group. Xaman wallet also said a wave of scams targeting XRP holders was continuing and reissued its existing security rules. It said it does not send users direct messages or emails and does not issue tokens or airdrops. It also said support services are provided only inside the Xaman app and not through external channels.

Xaman wallet also stressed in an earlier warning that users should be especially careful about scams on social media. It said users should not connect their wallets to unverified websites and should not respond to support guidance offered outside Xaman. It reiterated that support is available only within the app.

Doppler Finance also warned on X about accounts impersonating it. It said users should not rely only on the display name and should verify the account handle. It also said it never asks for private keys, seed phrases, passwords or funds via direct message.

False notices impersonating Ripple also spread. XRP community users found that a fake post was circulating on X claiming Ripple had launched an "XRP holder tier." The post tried to direct users to a specific website to receive an XRP badge, but it was confirmed as a phishing attempt rather than an actual Ripple notice.

In this situation, the common message from each service is clear. Users should avoid direct messages and ad links, distrust support guidance outside official channels, and not connect wallets to unverified sites or enter seed phrases. With fake sites copying well-known XRP ecosystem brands such as Ripple, Flare Network and Xora appearing, users are being asked to verify access routes and the authenticity of accounts themselves.

XRP PHISHING ALERT Fake sites clone Flare Network, XORA and other XRP brands. South Korean police separately probe fake staking sites. Estimated losses exceed ₩20B, about US$13.4M. ✅ Use https://t.co/r8t2vgKhAu ❌ Avoid ad and DM links Share across the XRP community