1. XRP Ledger Drainer Architecture
An XRP Ledger drainer is automated Web3 exploit software designed for the XRP Ledger protocol that triggers unauthorized transfers of native XRP and TrustLine tokens by tricking users into signing native transactions (Payment, TrustSet, OfferCreate) via Xaman (Xumm) or XRPL browser connectors.
Because the XRP Ledger relies on built-in native transaction primitives rather than custom Turing-complete smart contracts, XRPL drainers operate through direct ledger transactions executed over WebSocket RPC connections.
2. TrustSet (Trust Lines) Manipulation
To hold any non-XRP issued asset, an XRPL account must submit a TrustSet transaction establishing trust with an issuer address. Drainers manipulate this requirement:
- Victims are prompted to "create a TrustLine to claim an airdrop."
- The transaction authorizes a custom token issued by the attacker with an astronomical credit limit.
- Once established, the attacker uses the built-in decentralized exchange (DEX) to swap the victim's liquid XRP into worthless custom tokens in a single ledger ledger close.
3. OfferCreate DEX Sweeps & Arbitrage Traps
Attackers use the native OfferCreate transaction type to construct one-sided trading pairs on the XRPL decentralized order book. When a victim confirms a swap or trade payload, funds are liquidated into the attacker's book at 100% negative slippage.
4. Xaman / Xumm QR Signing Flow
Drainers interact with the Xaman mobile wallet via the XRPL Payload API over WebSockets. The victim scans a dynamic QR code on desktop or opens a deep-link on mobile; upon confirmation, the WebSocket listener receives the signed transaction blob and broadcasts it across XRPL rippled validator nodes immediately.
5. Frequently Asked XRP Drainer & Error Queries
Can an attacker drain native XRP without a Payment transaction?
Yes. By prompting a TrustSet transaction paired with an automatic DEX offer, the attacker forces an on-ledger trade that exchanges native XRP for custom issued tokens.
What is the base reserve requirement on XRPL?
XRPL requires a minimum reserve (currently 10 XRP + 2 XRP per active TrustLine) to keep accounts active. Drainers dynamically calculate AccountInfo.Balance - Reserve to ensure the sweep transaction does not fail due to reserve limits.
Explore our dedicated XRP drainer module or read our what is a crypto drainer overview.
valueless custom tokens using a hidden decentralized exchange pool.2.2. OfferCreate Transaction Hijacking
The `OfferCreate` transaction type is used to place buy or sell orders on the XRPL's native decentralized exchange. Drainers present a transaction that creates a sell order of the user's high-value tokens (or XRP) at a price of almost zero, matched instantly against the attacker's buy order. The transaction looks like a simple dApp interaction but instantly liquidates the wallet's contents.2.3. SignerListSet (Multi-Sig) Hijacking
Similar to TRON, the XRPL supports multi-signing via the `SignerListSet` transaction. If an attacker successfully tricks a user into signing a `SignerListSet` request (disguised as a network upgrade or account synchronization), they add their own public key with a weight that bypasses the original owner's key. The attacker then has full authority to withdraw all funds.3. Target Assets
XRP drainers focus on:- Native XRP (main target, sweeping the balance down to the network reserve)
- RLUSD and other major stablecoins on XRPL
- Custom issued assets and memecoins
- Escrowed XRP (by hijacking key permissions before release dates)
4. Case Study: The Ripple Reserve Upgrade Scam (Q2 2026)
In May 2026, scammers distributed a phishing campaign claiming that Ripple was lowering the network reserve from 10 XRP to 2 XRP, and users had to sign a transaction to "claim" the refunded XRP. The button on the phishing page initiated a `SignerListSet` transaction. Once signed, the attacker took control of the account, waited for the user to import additional funds, and swept the wallet.- Total Accounts Drained: 3,800
- Total XRP Stolen: 4.1 Million XRP (~$2.9 Million USD value)
- Attack Vector: Multi-sig hijacking via Xaman client API spoofing