An unexpected transaction appearing in a crypto wallet can raise immediate concerns, especially when it involves unfamiliar assets or large token amounts.
Life Coach and Web3 Consultant Stone recently reported finding two unexplained escrow transactions in his Xaman Wallet after another XRP Ledger community member contacted him about similar activity.
Stone said he checked his own wallet and discovered one transaction creating an escrow and another canceling it. Rather than interacting with the transactions, he used the Xaman Wallet’s support xAPP to ask about their origin and received a detailed explanation from Xaman support.
The response identified the activity as a known phishing tactic affecting users on the XRP Ledger. According to the support agent, scammers send unsolicited escrow transactions to different wallet addresses. These transactions can appear to contain significant amounts of tokens, including assets presented as USDT0 or other fake tokens.
Xaman Explains How the Scam Works
Xaman explained in his tweet that the purpose of these transactions is to persuade users to follow links included in transaction details or memos. The links may direct users to third-party websites that claim they can help users claim or release the escrowed funds.
🚨Attention XRPL Community 🚨
Today a community member reached out about strange transactions in their @XamanWallet and asked if I had any. I looked in my wallet and I found two escrow transactions… one for creation & another to cancel.
Utilizing the support xAPP within the… pic.twitter.com/35PtPw6WDn
— Stone (@Stone_XRPL) August 15, 2026
The wallet provider warned users not to connect their wallets or sign transactions prompted by these websites. According to Xaman, the malicious transaction can be designed to obtain authorization that allows scammers to take control of assets in the user’s account.
Importantly, Xaman stated that simply receiving an unsolicited escrow transaction does not compromise a wallet. The support agent said scammers cannot access funds merely by sending a transaction to an XRP address. Users must authorize a malicious transaction for the scammers to gain the permissions necessary to steal assets.
Why Users Cannot Block Incoming Transactions
Xaman also explained why these transactions can reach users despite their unsolicited nature. The XRP Ledger operates as a public, decentralized network, meaning an active wallet can send a transaction to another address.
As a result, users cannot selectively prevent other parties from sending transactions to their wallet addresses or remove those transactions from the public ledger. Xaman compared the situation to receiving unwanted physical mail: the recipient does not control who sends it.
We are on X, follow us to connect with us :- @TimesTabloid1
— TimesTabloid (@TimesTabloid1) June 15, 2025
The support response also clarified that any network fees associated with the suspicious transactions are paid by the sender, meaning the recipient does not incur those costs.
Stone Shares Xaman’s Security Guidance
Xaman said it had flagged the identified scammer account in its blacklist database. The company advised users to ignore unsolicited escrow transactions, avoid clicking links contained in transaction details, and never sign transactions they did not deliberately initiate.
Stone thanked Xaman for the prompt response and shared the guidance with the XRPL community. His report reinforces the importance of checking unexpected wallet activity through official support channels rather than interacting directly with unfamiliar transactions or websites.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
