Not financial advice. This guide is for educational security purposes only.
Market volatility is stressful, and when holders are nervous, scammers get creative. Scam Sniffer's 2025 report describes phishing activity as tracking market and user activity rather than moving in a simple direction with price — but there's a specific danger during downturns: fear-based scams. Fraudsters exploit uncertainty with fake "rescue" promises, bogus payout tokens, and urgent wallet alerts.
This checklist walks you through the concrete steps to verify your XRP wallet's safety. For self-custody wallets (hardware wallets, Xaman, or similar), use the full checklist below. For exchange or hosted-wallet deposits, focus on verifying your official deposit address and destination tag, plus account security on the exchange side.
1. Audit Your Trustlines (A Key XRPL-Specific Risk)
The XRP Ledger generally requires a trust line before an account can hold a standard issued token. A trust line is usually created or modified with a TrustSet transaction; some wallet flows may ask you to sign a TrustSet as part of preparing a token swap or DEX interaction. Scammers exploit this by tricking users into creating trust lines for fake issued tokens named "Ripple Reward" or "XRP Staking V2."
- Open Bithomp or XRPSCAN and paste your r-address.
- Navigate to the Trustlines or Tokens section.
- Look for any trustline you don't recognize.
- If you see suspicious issuers (look for random strings or names mimicking "Ripple," "Binance," or "Reward")—investigate and remove the trustline if it's empty.
To remove a trustline using Xaman, use the Token Trasher xApp / XRPL Services flow — open the xApp section in Xaman, find Token Trasher under XRPL Services, and follow the steps to remove an empty trustline (set limit to 0 and confirm with your security key).
Be aware that removing a trustline costs a small XRP fee and returns the owner reserve tied to that line. The current XRPL Mainnet reserve is 1 XRP base reserve plus 0.2 XRP owner reserve per owned ledger object — so freeing a reserve-counting trustline can recover about 0.2 XRP, though some first trustlines may be reserve-waived.
2. Check Your Recent Transaction History
During a price drop, some wallet drainers use low-value test transactions to validate they have access before sweeping the balance.
Look for:
- Unexpected outgoing XRP payments, even very small ones (a single drop = 0.000001 XRP), to unknown addresses. This may indicate you signed something you did not understand or that another key or control path is active.
- Unexpected SetRegularKey or SignerListSet transactions. These modify wallet control.
- Any transaction you don't remember authorizing.
Use Bithomp or XRPScan to review your recent transactions, especially activity around the period you are concerned about. Filter by transaction type and look for TrustSet, SignerListSet, or SetRegularKey.
3. Verify You Are Not Connected to a Phishing dApp
Scammers may use fake reward NFTs or XRP-themed phishing pages to lure users into signing transactions. Fake "payout" NFTs are mass-minted to flood wallets, and users who follow the linked claim flow or approve an unexpected NFT-related signing request may be tricked into authorizing a malicious transaction.
What to do:
- If you use a browser wallet (like GemWallet or XRP Ledger browser extensions), go to Connected Sites or Authorized dApps and revoke anything you don't use.
- If you use Xaman, check the Events tab for any unsolicited NFT airdrops.
- Do not interact with unfamiliar NFT "Claim Reward" or "Approve" prompts unless you can independently verify the source and the exact transaction you are signing. That interaction may trick you into signing a malicious XRPL transaction — such as a Payment, SetRegularKey, SignerListSet, or an NFT-related XRPL transaction such as NFTokenAcceptOffer or NFTokenCreateOffer — that empties your wallet.
- Bookmark your wallet's official site. Type the URL manually — don't click search ads or Telegram links.
4. Confirm Your Seed Phrase Has Never Leaked
You don't need a data breach notification to assume the worst if something feels off.
- Have you ever typed your seed phrase, private key, XRPL family seed, or Xaman Secret Numbers into any website, even a "wallet recovery" tool? If yes, treat the wallet as compromised.
- Have you taken a screenshot of your seed phrase on a phone with cloud backup? Treat the wallet as compromised.
- Have you shared a screen recording or photo that might have captured the phrase?
If you suspect exposure:
- Create a brand-new wallet using a hardware device or a clean software wallet.
- Generate the seed phrase offline.
- Send a small test transaction first. Once confirmed, move the full balance.
- For most users, do not use the old address for meaningful funds again. Advanced XRPL users may rotate control by setting a new Regular Key or SignerList and disabling the master key, but this must be done carefully after verifying the new control path works — it is not recommended unless you fully understand the trade-offs.
5. Verify the Destination Tag — Exchange Deposits
For exchange or hosted-wallet deposits, use the destination tag whenever the exchange deposit page requires one. Without the correct destination tag, funds can be delayed or lost. Scammers sometimes send small "test" deposits with fake tags — always verify the tag from the exchange's official page, not from emails or Telegram screenshots.
6. Lock Down the Wallet for the Bearish Period
If you're not actively trading, the safest posture is to minimize the attack surface.
- Move XRP to a supported hardware wallet, such as a Ledger device with the XRP app or a Trezor model that officially supports XRP. Store it somewhere physically safe.
- Configure multi-signing (SignerList) on the XRP Ledger with an appropriate signer quorum — for example, 2-of-3 if that fits your setup — instead of relying on a single key.
- Remove any unused trustlines (see step 1) to reduce the count of spam vectors.
- Disable Allow Rippling on non-exchange trustlines unless you explicitly need it for payment routing.
7. Know the Real XRP Reserve — Avoid Unnecessary Locked Funds
The XRP Ledger reserve consists of a base reserve (currently 1 XRP after the December 2024 fee vote) plus 0.2 XRP owner reserve per owned ledger object — such as a trust line, a current SignerList object, or an NFTokenPage. Note that the reserve has changed over time — older guides still quote 10 XRP / 2 XRP — so always check the current fee vote status.
Check your owner count on any ledger explorer. If it's high, you may have more locked reserve than you realize. Pruning unnecessary trust lines and NFTs frees that reserve and simplifies your wallet footprint.
The Bottom Line
Price drops don't directly cause security holes. What changes is your attention: fear makes you rush, and rushing is how people sign the wrong transaction or click the wrong link. Take these steps during quiet moments, not during panic hours.
For quick checks between full audits, you can verify any XRP wallet balance using the CryptoToolbox XRP balance checker — no seed phrase or private key ever leaves your device.
Summary checklist (copy-paste friendly):
- Audit all trustlines on Bithomp/XRPSCAN — remove unknown ones
- Review recent transactions for unexpected outgoing payments or SignerListSet
- Revoke connected dApps and browser wallet permissions
- Never approve unfamiliar NFT airdrops
- Confirm seed phrase / private key / Secret Numbers have never touched the internet
- Use the destination tag whenever the exchange deposit page requires one
- Consider hardware wallet or multi-signature for long-term storage
- Prune NFT/trustline items to reduce locked reserve and attack surface