An XRP investor transferred 14,646 XRP, worth about $16,800, to an unverified wallet after receiving a message that appeared to be part of a routine verification process. A blockchain researcher tracking suspicious activity said the request included the memo phrase “Safe XRPL verify message”, which made the transfer look legitimate.
What looked like a normal verification step was actually a social engineering trap. The analyst said the victim was persuaded to send XRP directly to a wallet controlled by the scammer, believing the transfer was part of a secure rewards-related check.
A flagged wallet still received the transfer
The wallet involved in the incident had already been marked as suspicious by XRP Ledger explorers, according to the investigation. Even so, the investor completed the transaction. Once a transfer is confirmed on XRP Ledger, an open-source blockchain network in the Ripple ecosystem, it cannot be reversed.
The report also explained the role of the memo field. On networks such as XRP Ledger, a memo is only a short note attached to a transaction and is meant to store information. It does not verify identity or authorize payments. Scammers exploit that field by inserting language that sounds official or secure, making a payment request appear trustworthy.
By the time the victim realized the mistake, the funds were already under the scammer’s control. The tokens could not be recovered after the transaction was finalized onchain.
Promise of 10% monthly returns drove the setup
The scam reportedly relied on a promise of 10% monthly returns. Offers like that can push investors to move quickly and reduce the time they spend checking wallet addresses, payment requests, and transaction details. That is often enough for obvious warning signs to be missed.
This pattern is common in crypto fraud. Bad actors use attractive rewards, limited-time offers, or exclusive access claims to lower a target’s guard. After trust is built, a seemingly harmless transfer request ends with assets being sent straight to the attacker’s wallet.
Users urged to verify every address and memo independently
Following the case, the warning to the XRP community was repeated in plain terms: every wallet address, payment request, and transaction memo should be checked independently. Messages that appear overly generous deserve extra scrutiny.
Experts said spending a few additional minutes reviewing transaction details can prevent losses worth thousands of dollars. The incident shows that even in a market with experienced participants, social engineering remains a serious risk for crypto users.