blockintAI · Research blog

One XRP Wallet, 15.3M XRP and a Deposit Tag Counter That Kept Running From 2024 Fake Exchanges Into 2026

BlockintAI · 2026-10-27T11:00:00.000Z

Fake crypto exchanges come and go. Their domains get reported, suspended and replaced. The deposit system behind them often does not change at all.

On March 20 and 26, 2024, the scam-warning site PCrisk published pages on three fake trading platforms, weyshare[.]com, venanco[.]com and cbusy[.]com, each with the wallet addresses the sites told users to deposit to. One XRP address appears on all three pages: rMrBAzHAHBtY7DvkSf8JkAsxn89HBnXoLD. The weyshare[.]com and venanco[.]com pages also list the same Stellar (XLM) address, GBKVX2PYUFUIBI45VDJKBRMNSR4UIKLBFKF3JAP2DQAY26YHRU4BSINA.

We read that XRP wallet's full public history on the XRP Ledger. It took in 15.3 million XRP from more than a thousand sending addresses. Each deposit carried a ten-digit destination tag, and those tags count up in one long sequence that later continued on other wallets. In October 2026 the same numbering is still in use on the XRP deposit address shown by sites live today, and the same XLM address is still collecting.

Key facts
Wallet XRP Ledger rMrBAzHAHBtY7DvkSf8JkAsxn89HBnXoLD, listed by PCrisk for weyshare[.]com, venanco[.]com and cbusy[.]com (March 2024)
Active March 18, 2023 to October 2024 (busiest July to September 2024); last deposit of more than $10 on Oct 10, 2026
Volume 15,303,731.06 XRP in 12,548 payments of 20 XRP or more, from 1,113 sending addresses (not a victim count)
How it credits users 12,898 of 12,984 deposits of 7.7 XRP or more carry a tag starting 1000; 10,965 distinct tags, climbing month by month
Same counter, next wallets rETfsremYZtH2B2hfJSar27sKQ5rT3YZZu (from Oct 2, 2024, 5.05M XRP in) and rDc1h1kcTuDR9JWhJbSyCFgCzLK81PESNm (from Nov 20, 2024, 3.20M XRP in), as of Oct 26, 2026
Still in use in 2026 XRP deposit address rBXUYa3pb8xEZTfwXGUxFJzkgPC4uSTcEU, tags from 1000255225, 78,868.72 XRP and never sent a payment, as of 7:54 AM CT Oct 26
Shared XLM wallet GBKVX2PY…SINA, on PCrisk's 2024 pages and on sites' deposit pages in October 2026; still receiving on Oct 26
Cash-out Endpoints include accounts XRPSCAN labels TradeOgre, KuCoin, ChangeNOW, Binance, FixedFloat and Gate.io; this does not implicate those services
BlockintAI reports rMrBAz wallet, forwarders and successor wallets, weareoxis[.]com and globaxio[.]com, 2026 deposit wallets incl. cryptovos[.]com

How a memo wallet works

On the XRP Ledger, an exchange does not need a new address for every customer. It can use one address and give each customer a destination tag, a number attached to the payment. The exchange's software reads the tag and credits the right account. Stellar does the same with a memo.

Fake exchanges copy this. The victim sees a deposit page with one address and "their" tag, sends XRP from a real exchange, and the fake site shows the balance growing. Everything sent lands in one wallet the operators control.

That design leaves a fingerprint. A wallet that sets the "destination tag required" flag on itself, and whose incoming payments carry tags that rise steadily over months, is a deposit wallet crediting many accounts from one numbering system.

The 2023–2024 wallet

rMrBAzHAHBtY7DvkSf8JkAsxn89HBnXoLD was activated on March 18, 2023 (12:32 AM CT) by a 10 XRP withdrawal from an account XRPSCAN labels Luno. That first payment already carried tag 1000043527. Three days later, on March 21, the wallet set the flag that makes a destination tag mandatory.

From then until October 2024:

  • 12,548 payments of 20 XRP or more, totaling 15,303,731.06 XRP, came from 1,113 sending addresses. Many of the senders are exchange withdrawal accounts, which is what you expect when individual users buy XRP on a real exchange and send it to a fake one. A sending address is not a person, so this is not a victim count.
  • Of the 12,984 incoming payments of 7.7 XRP or more, 12,898 carry a ten-digit tag starting with 1000, with 10,965 distinct tags. The range climbs month by month, from 1000043527–1000043570 in March 2023 to 1000109004–1000118747 in October 2024.
  • The busiest months were July 2024 (about 5.0M XRP), August (3.1M) and September (3.1M).
  • 15,310,041.54 XRP went out again to 469 recipients. The wallet held 85.39 XRP at 7:54 AM CT on October 26, 2026.

Its last deposit of more than $10 was 60.707348 XRP on October 10, 2026 (8:51 PM CT), long after the sites PCrisk named had gone quiet. At 7:57 AM CT on October 26, venanco[.]com redirected to a domain-sale page and weyshare[.]com answered with a Cloudflare block.

The counter moves to new wallets

In autumn 2024 the deposits moved, and the tags came with them.

  • On October 2, 2024, rMrBAz's tags had reached 1000116844 by 3:16 AM CT. At 5:57 AM CT a new wallet, rETfsremYZtH2B2hfJSar27sKQ5rT3YZZu, was activated by a 48.79 XRP payment carrying tag 1000116850, and set the tag-required flag six minutes later. 1,108 of its first 1,116 incoming payments carry tags from 1000116850 to 1000118626, from 124 sending addresses.
  • On November 20, 2024, rETfsrem's tags had reached 1000123193 by 11:08 AM CT (XRPSCAN). Seventeen minutes later, at 11:25 AM CT, another new wallet, rDc1h1kcTuDR9JWhJbSyCFgCzLK81PESNm, was activated by a 300 XRP payment carrying tag 1000123195 (XRPSCAN). It set the same flag the next day.

As of October 26, 2026, rETfsrem had received 5,054,371.82 XRP and rDc1h1kc 3,199,947.51 XRP. Each hands out the next numbers in the same sequence. That points to one deposit back end moving from wallet to wallet, not three unrelated wallets that happen to use similar tags. It is a shared deposit backend, not a shared operator: the same back end can serve many brands.

Where the XRP went

The three wallets paid out almost everything they received, much of it through forwarding wallets that rMrBAz itself activated. One of them, rGJPYPv4Q9SLXChnidZabH9S78PdL1a3S, received 1,639,710.11 XRP from rMrBAz, 1,511,954.48 XRP from rETfsrem and 293,432.49 XRP from rDc1h1kc, which ties the three wallets together through a common forwarder.

Among the endpoints these wallets paid directly are accounts XRPSCAN labels TradeOgre, KuCoin, ChangeNOW, FixedFloat, Binance and Gate.io. This does not implicate those services.

The single largest destination, rsQLJyai…Wbgh (5,339,443.76 XRP from rMrBAz), carries no XRPSCAN name. It is a tag-required account that has sent only about 800 transactions of its own, a possible service deposit account. Exchanges and swap services that received these funds hold the account records behind each deposit.

2026: the same numbering on live sites

The tag sequence did not stop in 2024.

The XRP deposit address that cryptovos[.]com showed in October 2026, rBXUYa3pb8xEZTfwXGUxFJzkgPC4uSTcEU, was activated on October 15, 2026 (2:13 PM CT) by a 400 XRP withdrawal from an account XRPSCAN labels Bitget, carrying tag 1000255225. It set the tag-required flag the same afternoon. Its ten-digit deposit tags since then run from 1000255225 up to 1000256835 (7:47 AM CT on October 26). As of 7:54 AM CT on October 26 it held 78,868.72 XRP and had never sent a payment.

On October 25, 2026, the deposit pages of weareoxis[.]com and globaxio[.]com displayed that same XRP address and the same XLM address, GBKVX2PY…SINA, handing out the next numbers on the same tag and memo counters as cryptovos[.]com (report). Both sites run the same front-end code as venanco[.]com's 2024 site: an archived 2024 sign-up page of venanco[.]com (Wayback Machine, June 6, 2024) loads app.min.js and sing-in.min.js files that are byte-identical to the files weareoxis[.]com and globaxio[.]com served at 7:57 AM CT on October 26, 2026 (SHA-256 beginning 84c100eb29667fad and 648f318c417aef7e; see also our report on the older kit generation). That day Cloudflare showed a "Suspected Phishing" warning in front of weareoxis[.]com.

So a deposit back end that PCrisk documented in March 2024 is still taking deposits under new brand names in October 2026, on both XRP and Stellar. This is a shared deposit backend, not a finding that one operator runs every brand.

The XLM wallet

GBKVX2PYUFUIBI45VDJKBRMNSR4UIKLBFKF3JAP2DQAY26YHRU4BSINA has been on Stellar since October 31, 2023. In the history the public Horizon server keeps (September 8, 2025 onward), it has received about 4.65M XLM in 1,062 payments. Its largest payouts went to accounts the StellarExpert directory names Bybit and MEXC, which does not implicate those exchanges, plus an unlabeled account, GC7IYMZA…TOSF (1,221,879.29 XLM). Most of its inflow, about 4.41M XLM, came from one unlabeled, high-volume account, GBYWFM64…32BE, a possible service whose pattern also fits a hot wallet (report).

It is still active. At 7:16 AM CT on October 26 it received 12,062.07 XLM from that same account, and at 7:54 AM CT it held about 71,589 XLM.

What this means

  • Domains are disposable; deposit wallets are not. weyshare[.]com, venanco[.]com and cbusy[.]com were flagged in 2024. The tag counter behind them kept running for at least two and a half more years, through at least four XRP wallets and a shared XLM wallet.
  • A destination tag is not your account. If a trading site gives you an XRP or XLM address with a tag or memo to "fund your account", the coins go to the site operator's wallet, shared with every other user. Withdrawals happen only if the operator chooses.
  • Watch the flag and the count. A new XRP address that requires tags and immediately receives payments with ten-digit tags in sequence is a deposit wallet. When those tags pick up where an earlier scam wallet stopped, it points to the same deposit back end.
  • The exchanges hold the next step. Most of the XRP that entered these wallets came from, and left to, labeled exchanges and swap services. Their records can link deposits to people.

If you were asked to deposit to any address in this post, or lost money to a trading platform you met online, report it to ic3.gov and the FTC, and file a report at blockint.ai so others can see the addresses involved.

Addresses in this post

XRP Ledger:

  • rMrBAzHAHBtY7DvkSf8JkAsxn89HBnXoLD (2023–2024 deposit wallet listed by PCrisk)
  • rETfsremYZtH2B2hfJSar27sKQ5rT3YZZu (deposit wallet on the same tag sequence, from Oct 2, 2024)
  • rDc1h1kcTuDR9JWhJbSyCFgCzLK81PESNm (deposit wallet on the same tag sequence, from Nov 20, 2024)
  • rGJPYPv4Q9SLXChnidZabH9S78PdL1a3S (forwarder activated by rMrBAz, paid by all three)
  • rBXUYa3pb8xEZTfwXGUxFJzkgPC4uSTcEU (2026 deposit address shown by cryptovos[.]com, weareoxis[.]com and globaxio[.]com)

Stellar:

  • GBKVX2PYUFUIBI45VDJKBRMNSR4UIKLBFKF3JAP2DQAY26YHRU4BSINA (XLM memo wallet on PCrisk's 2024 pages and 2026 deposit pages)

Sources