New XRPL Scam Exploits Memo Field to Steal XRP, Over $16,000 Lost in Documented Case
A newly documented scam targeting XRP Ledger users has been flagged, in which attackers use manipulated transaction memo fields containing the word 'safe' to create a false impression of legitimacy. In at least one reported case, 14,646 XRP valued at over $16,800 was stolen. Security observers are warning users that wallet software does not validate memo content and that user habits remain the primary line of defense.
A scam vector targeting XRP Ledger users has been publicly documented, with at least one confirmed case resulting in the theft of 14,646 XRP, valued at approximately $16,842 at the time of the incident.
The attack mechanism relies on the XRPL memo field, a data field attached to transactions that users may interpret as a verification or safety message. In this scheme, attackers write a memo reading 'safe XRPPL verify message' to imply the transaction has been validated or endorsed. The word 'safe' in this context carries no technical meaning and is entirely attacker-controlled.
The lure used in the reported case involved a promise of 10% monthly rewards, a common social engineering hook designed to make targets feel they are participating in a legitimate yield opportunity rather than sending funds to a malicious address.
- The memo field on the XRP Ledger can be written by any transaction sender and carries no security guarantee.
- Wallet interfaces do not flag or filter deceptive memo content.
- Users are advised to independently verify any transaction before signing, regardless of what memo text appears.
Security-focused community accounts have been circulating this warning, emphasizing that no software feature substitutes for user verification habits when approving XRPL transactions.
Key facts
- •14,646 XRP (over $16,800) stolen in a documented XRPL scam case
- •Attack exploits the XRPL transaction memo field with text reading 'safe XRPPL verify message'
- •The memo content is entirely attacker-written and carries no verification meaning
- •Scam lure involved a promise of 10% monthly rewards
- •Wallet software does not validate or flag deceptive memo content
- •Users advised to verify all transactions independently before signing