David Schwartz Warns XRPL Users After Surge in Wallet Drainer Scams

Highlights:

• David Schwartz warned XRPL users after fake XRP giveaway scams increased across social media platforms.
• Wallet drainer scams now steal XRP through fake airdrops and fraudulent wallet links.
• Ripple expanded security warnings as crypto-related cyber threats continued rising.

David Schwartz, Ripple’s former CTO, has warned XRPL users about a sharp rise in fake XRP giveaway scams and wallet drainer attacks this week. He issued the warning after scammers increased fake XRP promotions across Telegram, Instagram, X, and fraudulent websites targeting XRP holders. David Schwartz warned XRPL users that scammers now use fake XRP giveaway posts to steal funds and wallet access from victims. He also said scammers increasingly use impersonation accounts and fake support channels to target crypto users.

SCAM ALERT: There has been a huge escalation lately in airdrop and giveaway scams targetting XRPL users lately. Any such posts you see are likely scams.

Anyone claiming to be me on Instagram, Telegram, or almost anywhere else is likely a scammer.

Stay safe XRP fam.

— David 'JoelKatz' Schwartz (@JoelKatz) May 14, 2026

Scammers clone verified Ripple-related profiles and copy official branding to convince XRPL users that fraudulent XRP promotions are legitimate. Many scam accounts use edited videos, deepfakes, and stolen images of Ripple executives to promote fake giveaway campaigns across social media platforms. A fake Instagram account impersonated Brad Garlinghouse and asked XRP users to send tokens for a fake giveaway reward. The scam promised users larger XRP rewards after completing an initial transfer.

Ripple previously told XRP users that the company never requests XRP payments for giveaways, promotions, or support services. Ripple also clarified that it does not operate an official Telegram support channel. David Schwartz also warned XRPL users that anyone claiming to represent him on Telegram or Instagram likely operates a scam account.

Attackers disguise wallet drainer links as XRP airdrop registration pages and fake Ripple support tools targeting XRPL holders. Once users connect wallets, malicious contracts quickly transfer funds from connected accounts. Scammers also reply under legitimate Ripple and XRP posts to redirect users toward fraudulent wallet connection websites. XRPL users cannot recover stolen funds after scammers transfer XRP from compromised wallets.

Wallet Drainer Scams and Device-Level Security Risks Draw Fresh Attention

David Schwartz also warned crypto users this week about a newly disclosed Windows BitLocker vulnerability affecting encrypted storage devices. David Schwartz described the BitLocker exploit as one of the most serious device security threats affecting crypto users in recent years.

Reports said attackers could reportedly bypass BitLocker encryption on affected Windows systems without triggering authentication prompts. Researchers also said attackers needed minimal technical effort to bypass encryption protections on affected devices.

This is easily one of the worst security vulnerabilities I have ever seen. Microsoft has some 'splaining to do! https://t.co/Ai50kHGDGJ

— David 'JoelKatz' Schwartz (@JoelKatz) May 14, 2026

The BitLocker vulnerability threatens crypto holders storing private keys, seed phrases, and cold wallet backups on Windows computers. Attackers could access crypto wallet backups and sensitive files after bypassing BitLocker protections on compromised devices. Many retail crypto investors store wallet recovery phrases and backup files on Windows systems protected through BitLocker encryption.

Some security researchers have questioned whether the BitLocker exploit functioned more like a hidden backdoor than a normal software flaw. Researchers pointed to the reportedly simple USB-based method used to bypass encryption protections on affected systems. The vulnerability also increased fears that attackers could target crypto holders directly through personal computers.

Ripple Expands Security Response as Cyber Threats Grow More Advanced

The warning by the former CTO about wallet drainer scams comes days after Ripple started sharing crypto-related intelligence with other organizations. The company recently shared North Korea-linked threat intelligence with Crypto ISAC to help track cyberattack campaigns. Ripple shared suspicious wallet addresses, malicious domains, and fraud indicators tied to active North Korea-linked hacking operations.

North Korea-linked hackers reportedly use long-term social engineering campaigns to target crypto users, exchanges, and blockchain platforms. Attackers increasingly use impersonation tactics, fake communications, and trust-building schemes instead of simple code exploits.