Seoul police have uncovered a fake Flare Network staking operation that extracted 3.4 million XRP, worth roughly $8.5 million at the time, from 71 investors over a single week in October 2025, and authorities believe the final tally could approach $19 million. Two men have been detained on aggravated fraud charges; a third suspect is overseas with an arrest warrant and an Interpol Red Notice pending. The case matters because it shows how easily a legitimate project’s brand can be weaponized to harvest retail capital, and how quickly the proceeds vanish across borders.
The scheme and the take
The fraudulent site ran from October 16 to October 23, promising monthly returns of 1.5 percent to 1.8 percent for depositing what the promoters misspelled as “Rippke.” The scammers built a website using Flare’s name and amplified it through Naver blogs, online news articles, Wikipedia edits and YouTube videos, a full-spectrum impersonation campaign that turned a week of operation into an eight-figure haul. Police say the investigation is still expanding, and the $8.5 million confirmed so far may be only the provable floor.
The legitimate project caught in the crossfire
Flare Network, a blockchain with deep roots in the XRP ecosystem that launched in early 2023, reported more than $160 million in total value locked and over 887,000 active addresses as of late March 2026. None of that infrastructure was compromised; the fraudsters simply borrowed the reputation. For a project trying to prove real-world utility, the association, however involuntary, is a credibility tax it did not ask for and cannot easily refund.
The scale problem
Chainalysis estimated in January that crypto scams and frauds swallowed as much as $17 billion globally in 2025, with criminals increasingly using impersonation tactics and artificial intelligence to industrialize victim acquisition. The Seoul case is a rounding error in that total, but its mechanics, a cloned brand, a compressed timeline, a promised yield that looks plausible until it isn’t, are the template. The police zero-tolerance pledge is the standard response; the Interpol notice is the standard escalation. Neither has yet reversed a transaction.
What comes next
The third suspect’s location is unknown, and the bulk of the XRP has almost certainly been moved through mixers or swapped into less traceable assets. Seoul’s Cyber Crime Investigation Unit will keep tracing, but the money moves faster than the paperwork. Investors are left with the usual lesson: a monthly yield of 1.5 percent on a staking product that cannot explain its source is not an opportunity. It is a countdown.