XRPL Token Safety Guide

1. 1
   The issuer. Anyone can issue a token under any name, so the name proves nothing: the issuer’s address does. Check it against the project’s own site before buying, and copy it, never retype it.
2. 2
   Whether it can issue more. An issuer that has disabled its master key and has no usable regular key can never sign again, so it can never mint more (“blackholed”). One that still holds its keys can add supply at any time.
3. 3
   Whether it can freeze or claw back. An issuer can freeze holders unless it has given up that power, and can take tokens back if it switched on clawback before issuing (freezes, clawback). Fine for a regulated stablecoin; a warning sign for a meme coin.
4. 4
   The transfer fee. An issuer can charge a fee, up to 100%, every time its token moves between holders, including when you sell (xrpl.org). xrpl.to shows it on the token’s page whenever there is one.
5. 5
   What you can sell into. The XRP in its pool and the bids on its order book are the most you could ever get back out. A large holder selling first drains them.
6. 6
   Who holds it. The share held by the top ten wallets, and whether the creator still holds a large part. A few wallets holding most of the supply can sell into the pool before anyone else.
7. 7
   Whether the pool can be pulled. Liquidity tokens that were burned or are locked cannot be withdrawn; ones in the creator’s wallet can be, taking the pool’s XRP with them.

xrpl.to also gives every active token a risk review on its page, scored from what happened to earlier tokens, and keeps a scam list of addresses and websites. For RLUSD, the right issuer is rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De.

A trust line means a token only reaches you if you accepted it, but scammers do not need tokens to reach you. What arrives instead:

• A website that asks you to sign. “Claim your rewards” or “verify your wallet”: the transaction you sign hands over the account. A real airdrop never needs a signature (airdrop checker).
• Offers, checks and memos from strangers. An NFT offer for a large amount, an “incoming” check or escrow, a tiny payment with a link in its memo. Each exists to send you to a website.
• A copy of a real token. Same name and logo, different issuer. Search results that put it first are not a recommendation.
• A seed request. Support staff, wallet “validation” sites and recovery services that ask for your secret key are always thieves.

• No token approvals. There is no allowance to give a contract that can later spend your tokens, so the approval drains common on other chains do not exist here.
• No surprise code in the token. A token’s rules are the ledger’s own, so a sell cannot be secretly blocked by hidden code. Its issuer’s only controls are freezing (one holder, everyone, or deep), clawback, requiring approval to hold, and the transfer fee, and every one of them is visible on the ledger.
• Front-running still exists. Bots run sandwich trades here too, so keep your slippage limit tight (how sandwich attacks work).

How do I know if an XRP Ledger token is a scam?

Check the issuer address against the project’s own site, whether the issuer can still mint, freeze or claw back, the transfer fee, how much XRP sits in its pool and how much the top wallets hold. xrpl.to shows each on the token’s page, with a warning on tokens it has flagged.

What does blackholed mean on the XRP Ledger?

The issuer account has disabled its master key and has no usable regular key, so nobody can ever sign for it again. Its token’s supply can never grow.

Can a token I hold be taken back?

Only if its issuer enabled clawback before issuing it. An issuer can also freeze holders unless it gave up that power. Both show on the token’s page.

Checking a token’s liquidity · NFT scams · How to buy a token