Key Takeaways
- • $8.5 million confirmed theft: Scammers stole 3.4 million XRP from 71 investors via a counterfeit Flare Network staking website operating for just eight days (October 16–23, 2025) in South Korea, with Seoul police estimating total losses may reach $19 million as investigations expand.
- • Sophisticated impersonation scheme: Fraudsters used the legitimate Flare Network and FXRP token branding to create a credible facade, planting fake content across Wikipedia, blog posts, news articles, and YouTube videos to deceive victims into depositing funds for promised monthly returns of 1.5–1.8%.
- • Three suspects identified, two detained: Seoul Metropolitan Police detained two men on aggravated fraud charges, while a third accomplice remains at large with an Interpol Red Notice requested and an active arrest warrant issued.
- • Asset recovery in progress: Investigators traced 27.3 billion won through linked wallets and froze 17.3 billion won, referring multiple suspects for fraud prosecution as authorities continue expanding the scope of the investigation.
- • Broader crypto scam epidemic: The incident underscores escalating risks in cryptocurrency fraud and impersonation schemes targeting institutional and retail investors seeking yield opportunities in digital assets.
Summary
Seoul police have dismantled a sophisticated cryptocurrency fraud scheme that exploited 71 investors through a fake Flare Network staking website, resulting in confirmed losses of approximately $8.5 million in XRP tokens. The fraudulent operation ran for just eight days in October 2025—from October 16 to October 23—but managed to accumulate 3.4 million XRP before being shut down. Authorities now estimate the total theft could exceed $19 million, suggesting the scope of the scheme remains incompletely understood as investigations proceed.
The scammers executed a highly coordinated impersonation campaign, leveraging the established credibility of the legitimate Flare Network blockchain project and its FXRP token. To amplify legitimacy, fraudsters planted promotional content across multiple platforms including Wikipedia entries, blog posts, news articles, and YouTube videos. Victims were lured with promises of consistent monthly returns ranging from 1.5% to 1.8% on deposited XRP, a yield proposition designed to appeal to both institutional investors and retail participants seeking passive income opportunities in the digital asset space.
Law enforcement response has been swift but incomplete. The Cyber Crime Investigation Unit at the Seoul Metropolitan Police detained two suspects on aggravated fraud charges, while a third accomplice remains at large. Authorities have secured an arrest warrant for the fugitive and submitted a request for an Interpol Red Notice to facilitate international apprehension. Investigators have successfully traced 27.3 billion won across linked wallets and frozen 17.3 billion won in assets, substantially limiting the scammers' ability to move or liquidate proceeds.
The incident reflects a broader pattern of rising cryptocurrency fraud globally, with scammers increasingly targeting yield-seeking investors through impersonation of legitimate blockchain projects and decentralized finance platforms. The speed of execution—confining operations to an eight-day window—coupled with the multi-channel distribution strategy suggests organized, professionally executed fraud operations rather than opportunistic schemes, raising concerns about the infrastructure and tools available to sophisticated threat actors in the crypto ecosystem.
The scammers executed a highly coordinated impersonation campaign, leveraging the established credibility of the legitimate Flare Network blockchain project and its FXRP token. To amplify legitimacy, fraudsters planted promotional content across multiple platforms including Wikipedia entries, blog posts, news articles, and YouTube videos. Victims were lured with promises of consistent monthly returns ranging from 1.5% to 1.8% on deposited XRP, a yield proposition designed to appeal to both institutional investors and retail participants seeking passive income opportunities in the digital asset space.
Law enforcement response has been swift but incomplete. The Cyber Crime Investigation Unit at the Seoul Metropolitan Police detained two suspects on aggravated fraud charges, while a third accomplice remains at large. Authorities have secured an arrest warrant for the fugitive and submitted a request for an Interpol Red Notice to facilitate international apprehension. Investigators have successfully traced 27.3 billion won across linked wallets and frozen 17.3 billion won in assets, substantially limiting the scammers' ability to move or liquidate proceeds.
The incident reflects a broader pattern of rising cryptocurrency fraud globally, with scammers increasingly targeting yield-seeking investors through impersonation of legitimate blockchain projects and decentralized finance platforms. The speed of execution—confining operations to an eight-day window—coupled with the multi-channel distribution strategy suggests organized, professionally executed fraud operations rather than opportunistic schemes, raising concerns about the infrastructure and tools available to sophisticated threat actors in the crypto ecosystem.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.