“Flare’s XRPFi Distribution Has Started” – Fake Airdrop Scam Targeting $XRP Holders
Updated October 4, 2026
This one is more dangerous than most. Not because the mechanics are new – they aren’t – but because the execution is polished enough to fool experienced holders.
I documented it live on May 11, 2026. The screenshots are real, and the site was still active when I wrote this up.
The short version: there is no “Flare XRPFi airdrop” and no FXRP airdrop. FXRP is real, but you get it by minting it with your own XRP or swapping for it – nobody gives it away. Any post or site offering to send you FXRP or FLR after you “check eligibility” or “verify your wallet” is a wallet drainer.
What the Scam Looks Like
A post appears on X, replying to a popular XRP account. It reads:
🪂 Flare’s XRPFi distribution has started!
Eligible XRP holders can now claim their drop.
Check your eligibility: 👇
Attached is a professional-looking banner with the real logos of Flare, XRP, Uphold, and Xaman – four legitimate, trusted brands in the XRP ecosystem. The banner reads “FXRP Airdrop Distribution – Round 1 Live.” At the bottom of the image, in small text: x-eligibility-portal.pages.dev
That URL is the first red flag. We’ll get to it.
Click the link and you land on a site that looks like this:
- XRP logo in the header
- Flare branding throughout
- A countdown timer: “XRPFi Event for Holders | 04h 19m 08s”
- Headline: “Flare XRP Airdrop Is Now Live”
- Body copy: “eligible holders can now check their allocation and claim FXRP directly to their wallet. Participation is simple, secure, and requires no additional steps beyond wallet verification.”
- A large blue button: Check Eligibility →
Everything about this page is designed to look like a real project announcement. And every single link on the page – Check Eligibility, Learn More, Contact Us, every footer link – leads to a wallet connection prompt.
Why $XRP Holders Are the Target
This scam works because it exploits real history.
Flare Network really did distribute FLR tokens to XRP holders. It was one of the most anticipated airdrops in the XRP community: a snapshot in December 2020, an initial distribution in January 2023, and then monthly “FlareDrops” that ran for three years. Flare announced that the final FlareDrop would take place on January 30, 2026, closing out the distribution phase for good.
Then, in September 2025, Flare launched FXRP on mainnet – a version of XRP you can use in DeFi on Flare, created by locking real XRP through its FAssets system. FXRP is real and it’s been in the news. That’s what makes this scam work: “Flare,” “XRP,” “FXRP,” and “distribution” all sound like things that have genuinely happened. Our Flare XRPFi and FAssets explainer covers how FXRP actually works – and it’s obtained by minting or swapping, never by airdrop.
That familiarity is the weapon. When you see “Flare” and “XRP” together next to the word airdrop, your pattern recognition says this has happened before. The scammers know this and built every element of the site around that association.
This is a step up from generic fake airdrops. It’s targeted, researched, and credible-looking to exactly the audience it’s trying to drain. And it’s part of a much bigger wave: in May 2026, Xaman’s founder Wietse Wind warned that 20+ new X accounts impersonating Xaman and 10+ new scam domains pretending to be Xaman appear every day – adding, plainly, “There is no desktop wallet! No airdrop!”
The Red Flags – Dissected
1. pages.dev is a free Cloudflare hosting subdomain
The URL is x-eligibility-portal.pages.dev. Pages.dev is Cloudflare’s free website hosting – the equivalent of netlify.app or vercel.app. Anyone can put a site there in minutes, for free, with nothing more than an email signup.
The real Flare Network lives at flare.network. Real XRP Ledger resources are at xrpl.org. No legitimate distribution for an asset this size runs on a free subdomain.
This is the single fastest check you can do: look at the domain before anything else. Free subdomain on a “claim” page = stop immediately.
2. The countdown timer
“04h 19m 08s” – a ticking clock right at the top of the page. No legitimate airdrop expires in four hours without any prior announcement through official channels. The timer exists for one reason: to make you act before you think.
Real distributions are announced well in advance through official project channels, covered by crypto media, and discussed openly in communities. They don’t appear out of nowhere with a four-hour window.
3. Stolen logos from four real projects
The banner uses the real logos of Flare, XRP, Uphold, and Xaman. That’s deliberate trust engineering – each logo is borrowed authority. None of these companies has anything to do with this site.
Before trusting any airdrop that uses brand logos, check each project’s official channels to see whether they’re actually running it. One post from the real account confirms it or kills it instantly.
4. “Requires no additional steps beyond wallet verification”
This phrase is worth stopping on. It’s designed to make connecting your wallet sound routine and safe. “Wallet verification” isn’t a real step in legitimate airdrops. What they actually mean is: connect your wallet and sign something.
What that signature does depends on the wallet, and both versions are dangerous:
- On Flare and other EVM wallets (MetaMask, Bifrost and similar), it’s typically a token approval or permit signature that lets a contract move your tokens. Our wallet drainer approvals guide explains exactly how that works.
- On the XRP Ledger (Xaman and similar), the request can be a payment that sends your XRP straight to the scammer, or a change to your account settings that hands control of the account to someone else. Xaman shows you the transaction type before you sign – if it’s anything other than what you expected, reject it.
The language is chosen specifically to make that action sound administrative rather than dangerous.
5. Every link on the page leads to a wallet connector
This is the clearest possible evidence of intent. A real project site has content – documentation, team pages, blog posts, announcements. When every navigational element – the footer links, the “About” section, the “Contact Us” button – routes to a wallet connection prompt, the site has no other purpose. It’s a drainer with a webpage built around it.
How It Spreads
Unlike the DM-based scam in our fake moderator article, this one spreads through public posts on X.
The post appears as a reply to a popular XRP community account. That’s deliberate – replies to big accounts are seen by that account’s followers, and people reading a thread on a hot topic are already in a receptive frame of mind.
The scammers aren’t just sending DMs to individuals anymore. They’re embedding themselves in legitimate conversations at scale. A new or casual user scrolling XRP news sees what looks like an official announcement inside a thread they were already reading.
The number at the end of the link – in this case ?597935 – is a tracking ID. It tells the operator which post or campaign brought in the click. This is an organized operation, not a one-off attempt.
What To Do
If you saw the post but didn’t click: Block and report the account that posted it. No further action needed.
If you visited the site but didn’t connect your wallet: You’re fine. Browsing a site without connecting causes no harm. Close it, block the source account, move on.
If you connected your wallet but didn’t sign anything: Disconnect the site in your wallet’s connected-sites settings and don’t sign anything it asks for. Connecting alone usually can’t move your funds.
If you signed a transaction or signature: Act immediately.
- Move everything that’s left to a brand-new wallet with a new recovery phrase – speed matters most
- On Flare or other EVM wallets, revoke unknown token approvals using Revoke.cash, which supports the Flare network
- On the XRP Ledger, look up your account on an explorer like XRPScan and check whether someone added a key or signer you didn’t set up – if so, the account is no longer only yours
- Treat the compromised wallet as burned – don’t keep using it as your main wallet
- Report the site to Cloudflare’s abuse team at abuse.cloudflare.com, report the X account, and if you lost funds in the US, file a report at ic3.gov
- Ignore anyone who contacts you offering to recover your funds for a fee – that’s a follow-up scam
The Broader Pattern
This was the second wallet drainer I documented in a short period, and the evolution between the two is notable:
| DM Scam (April 2026) | Fake Airdrop Post (May 2026) | |
|---|---|---|
| Delivery | Private DM | Public X reply |
| Hosting | netlify.app | pages.dev |
| Target | Generic new crypto accounts | Specifically $XRP holders |
| Design quality | Basic | Professional |
| Trust mechanism | Fake moderator persona | Stolen logos from 4 real projects |
| Urgency tactic | Follow-up DM pressure | Countdown timer |
The mechanics are identical. The packaging keeps getting better.
The strongest defense is one that doesn’t depend on spotting the scam in time: keep your main holdings in a hardware wallet like a Ledger or Trezor, and never connect it to anything you reached through a social media link. If you only ever connect a separate, low-balance “burner” wallet to unfamiliar sites, a mistake costs you the burner, not your savings.
The second line of defense is the verification habit: before interacting with any airdrop claim, check the official project’s own X account and website directly. If it’s not announced there, it doesn’t exist. We track real, verified opportunities on our Active Airdrops page.
Seen a variant of this scam targeting a different token community? Drop it in the comments – documenting these keeps the playbook visible.
📖 In This Section Complete Security Guide · Real Scam DM Dissected · Evaluate Projects · Real Airdrops
No. FXRP is real, but it isn’t airdropped. You get FXRP by minting it with your own XRP through Flare’s FAssets system or by swapping for it on a Flare exchange. Any post or website offering to send you FXRP after you check eligibility or verify your wallet is a scam.
No. Flare distributed FLR to XRP holders through an initial airdrop in January 2023 followed by three years of monthly FlareDrops, and Flare announced the final FlareDrop for January 30, 2026. There is no ongoing distribution, so any new “Flare airdrop” for XRP holders is fake.
Check the web address first. Real projects use their own domains, such as flare.network, while scam sites often sit on free hosting like pages.dev, netlify.app, or vercel.app. Countdown timers, “wallet verification,” stolen logos from several brands, and every link leading to a wallet connection are all signs of a drainer. If the official project account hasn’t announced it, it doesn’t exist.
Revoke.cash works on Flare and other EVM networks, but not on the XRP Ledger, which doesn’t use token approvals the same way. On the XRP Ledger, a malicious signature can send XRP directly or change who controls your account. If you signed something on a scam site with an XRPL wallet like Xaman, move your funds to a new wallet and check your account settings on an explorer such as XRPScan.
No. In May 2026, Xaman’s founder warned that 20 or more new fake Xaman accounts and 10 or more new scam domains appear every day, and stated plainly that there is no desktop wallet and no airdrop. Only download Xaman from the official app stores via its official website, and ignore any Xaman airdrop offers.
If you only connected and didn’t sign anything, disconnect the site and don’t sign anything it asks for. If you signed, move your remaining funds to a brand-new wallet immediately, revoke unknown approvals on Revoke.cash if you used a Flare or EVM wallet, report the site and account, and file a report at ic3.gov if you’re in the US. Ignore anyone offering paid recovery.
Sources:
