Core Finding: Because XRP Ledger lacks Turing-complete smart contracts, XRPL drainers exploit native ledger operations: manipulating TrustSet credit lines and executing off-market OfferCreate DEX orders to transfer wealth.
- Exploit Operations: TrustSet limit manipulation and zero-rate OfferCreate order matching against adversary orderbooks.
- Supported Wallets: Xaman (formerly Xumm), Crossmark, and Web3 XRPL mobile clients via QR payload signing.
- Execution Speed: Validated in 3-5 seconds (standard XRPL ledger close consensus cycle).
1. XRP Ledger Drainer Architecture
An XRP Ledger drainer is automated Web3 exploit software designed for the XRP Ledger protocol that triggers unauthorized transfers of native XRP and TrustLine tokens by tricking users into signing native transactions (Payment, TrustSet, OfferCreate) via Xaman (Xumm) or XRPL browser connectors.
Because the XRP Ledger relies on built-in native transaction primitives rather than custom Turing-complete smart contracts, XRPL drainers operate through direct ledger transactions executed over WebSocket RPC connections.
2. TrustSet (Trust Lines) Manipulation
To hold any non-XRP issued asset, an XRPL account must submit a TrustSet transaction establishing trust with an issuer address. Drainers manipulate this requirement:
- Victims are prompted to "create a TrustLine to claim an airdrop."
- The transaction authorizes a custom token issued by the attacker with an astronomical credit limit.
- Once established, the attacker uses the built-in decentralized exchange (DEX) to swap the victim's liquid XRP into worthless custom tokens in a single ledger ledger close.
3. OfferCreate DEX Sweeps & Arbitrage Traps
Attackers use the native OfferCreate transaction type to construct one-sided trading pairs on the XRPL decentralized order book. When a victim confirms a swap or trade payload, funds are liquidated into the attacker's book at 100% negative slippage.
4. Xaman / Xumm QR Signing Flow
Drainers interact with the Xaman mobile wallet via the XRPL Payload API over WebSockets. The victim scans a dynamic QR code on desktop or opens a deep-link on mobile; upon confirmation, the WebSocket listener receives the signed transaction blob and broadcasts it across XRPL rippled validator nodes immediately.
3.1 Orderbook Frontrunning & Slippage Traps
The `OfferCreate` transaction type is used to place buy or sell orders on the XRPL's native decentralized exchange. Drainers present a transaction that creates a sell order of the user's high-value tokens (or XRP) at a price of almost zero, matched instantly against the attacker's buy order. The transaction looks like a simple dApp interaction but instantly liquidates the wallet's contents.4. SignerListSet Multi-Sig Account Hijacking
Similar to TRON, the XRPL supports multi-signing via the `SignerListSet` transaction. If an attacker successfully tricks a user into signing a `SignerListSet` request (disguised as a network upgrade or account synchronization), they add their own public key with a weight that bypasses the original owner's key. The attacker then has full authority to withdraw all funds.5. Target Assets across XRPL
XRP drainers focus on:- Native XRP (main target, sweeping the balance down to the network reserve)
- RLUSD and other major stablecoins on XRPL
- Custom issued assets and memecoins
- Escrowed XRP (by hijacking key permissions before release dates)
6. Case Study: The Reserve Upgrade Scam (Q2 2026)
In May 2026, scammers distributed a phishing campaign claiming that Ripple was lowering the network reserve from 10 XRP to 2 XRP, and users had to sign a transaction to "claim" the refunded XRP. The button on the phishing page initiated a `SignerListSet` transaction. Once signed, the attacker took control of the account, waited for the user to import additional funds, and swept the wallet.- Total Accounts Drained: 3,800
- Total XRP Stolen: 4.1 Million XRP (~$2.9 Million USD value)
- Attack Vector: Multi-sig hijacking via Xaman client API spoofing