Ripple co-founder and CTO David Schwartz has issued an urgent public warning about what he described as a 'huge escalation lately in airdrop and giveaway scams targeting XRPL users', according to reports from Ripple News. The warning, posted to his 700,000-plus followers on X, arrives as XRP commands elevated institutional attention and retail volume, precisely the conditions that make its holder base a high-value phishing target. Schwartz explicitly warned that 'Anyone claiming to be me on Instagram, Telegram, or almost anywhere else is likely a scammer.'
The dominant attack vector involves fake airdrops where users are directed to fraudulent promotional sites promising free XRP tokens, as reported by Ripple News. Connecting a non-custodial wallet triggers a malicious script, a wallet drainer, that executes a single authorized transaction to empty holdings before the user realizes what happened. The authorization step is the trap; once signed, the transaction is irreversible on-chain. Giveaway scams operate through social engineering, promising to return twice any amount of XRP sent to scammer-controlled addresses, packaging pitches around fabricated Ripple announcements or milestone celebrations.
The delivery infrastructure has matured significantly in 2026, with attackers deploying AI-generated deepfake videos on TikTok and YouTube that clone Schwartz's likeness and voice with enough fidelity to fool retail holders, according to Ripple News. In a notably sophisticated attack vector, Schwartz flagged a phishing campaign that injected fake emails into Robinhood's infrastructure, exploiting Gmail's dot-trick for account creation and embedding malicious HTML payloads in device names. These messages passed SPF, DKIM, and DMARC authentication checks, making them appear as legitimate Robinhood correspondence.
Fake accounts impersonating Schwartz and Ripple CEO Brad Garlinghouse have proliferated on Instagram and Telegram, with Ripple reporting over 50 such accounts on both platforms in Q1 2026 alone, as reported by Ripple News. The warning comes as XRP commands elevated institutional attention and retail volume, precisely the conditions that make its holder base a high-value phishing target, representing a bearish signal for ecosystem trust.
