XRP memo wallet rMrBAzHA…XoLD follow-up: forwarders, two more tag-required wallets on the same counter, and the XLM wallet's top funder; 21 addresses
- Scam type: Scam
- Chain: XRP Ledger
- Project or site name: rMrBAz XRP memo wallet forwarders (weyshare / venanco / cbusy fake exchanges)
- Incident date: 2026-10-25
- Reported: 2026-10-26
- Last updated: 2026-10-26
This follows up https://blockint.ai/c3?report=7c94921c-7a3e-49ad-a915-3850150605e2 on the XRP memo wallet rMrBAzHA…XoLD, which PCrisk listed for the 2024 fake exchanges weyshare[.]com, venanco[.]com and cbusy[.]com, and on the XLM memo wallet GBKVX2PY…SINA, filed in https://blockint.ai/c3?report=2d017335-c055-48e2-a67c-c448111caeb5 and also shown by weareoxis[.]com and globaxio[.]com (https://blockint.ai/c3?report=3b241106-c4c4-41c2-a54d-0a2e03a0b2cd). We traced where their funds went on-chain on 2026-10-25. Filed here: 21 addresses (19 XRP, 2 XLM), 3 of them low confidence. Wallets already…
Other addresses in this report: rJji8jahUEwNjoYiFaKM2qWYWFZ25f9SfQ, rJ4fe1v2E4i1oT3eQPJ74VPMZ4h23tchjK, rKCn4CnsPvCisUXth8aTPnEaAV48gazBMf, rJGpxJaJaQZdtCWUUAeANAv9cyKagZG8ob, rETfsremYZtH2B2hfJSar27sKQ5rT3YZZu, rDc1h1kcTuDR9JWhJbSyCFgCzLK81PESNm, rfih9mHs7qiF1CvgkKQK87VVeqCHVv4RXY, rMsUJGT89WQMUFUwBJjqRtHGGXWqs7KUFi, rsXkv8pkWQ8LDSiReFk1QeekbN6BNyJjYD, rnGtXdyEcXtTk38xjm4TYHK5Kik8PFy6cV, rG8LBP9qk7p9y6sFwDxu32azrwHzsn98r8, rDnfHS26cgGEMbiKik6wkCKDWPsujXBBdf, r4kPxU75wqRdMsMXt9pQuDhQGYto76EaUF, rHT6KH6j555575TcnqCKS9NvqhSSc1sj3g, rJeVS9t29k4owWL6gPkLVXakdB9d6zUYW, rpi2uzsU8a47FHQr583xJC7qmD5Hd1ZT3a, rHwgdh6yV879BdwbpDJJZGr7s8za82a9dh, rLqmzLenVGtSBN7bASWMdWZWitx15hRdk5, GAWDLHRXLZM2G5CD6GHQJFQEZKTY6QMDFROX22VAVB2A2RJNUHFUYPM5, GBYWFM64ZPPRWW7FFARZ5CSHJ7MC5IZGALWF32HMAX3ZLT6ZA3CX32BE
Websites in this report: weyshare.com, venanco.com, cbusy.com
Linked reports: XRP memo wallet rMrBAz…XoLD listed for 2024 fake exchanges weyshare[.]com, venanco[.]com, cbusy[.]com: 15.3M XRP in, same tag scheme as cryptovos, Deposit wallets of 6 'calm-ui' kit fake exchanges incl. cryptovos[.]com, coinsco[.]io, hederabit[.]com: 131 addresses, shared TON backend (Oct 2026), weareoxis[.]com, globaxio[.]com: 2024-version kit fake exchanges on cryptovos[.]com's XRP/XLM memo counters and a 2024 Monero wallet; 22 new addresses