Seoul police detain two over fake Flare staking site that took 3.4 million XRP

Two men are in custody in South Korea on aggravated fraud charges over a counterfeit Flare Network staking website that police say collected 3.4 million XRP — about $8.5 million at the time — from 71 investors last year. A third alleged participant is abroad and at large, and investigators have secured an arrest warrant and asked Interpol for a Red Notice.

The case was reported on July 30 by CoinDesk, which attributed the details to the South Korean daily Chosun and to the Korea JoongAng Daily. Decrypt published the same headline figures the same day — $8.5 million in XRP, a fake Flare staking site, Seoul police as the source. The underlying account in both cases traces to the Cyber Crime Investigation Unit of the Seoul Metropolitan Police via Korean-language reporting; no charging document or police statement has been published in English.

The mechanics

The pitch was yield. According to the police account relayed by Chosun, the site told depositors they would receive a return of 1.5% to 1.8% every month. That is roughly 18% to 21.6% a year simple, or a little under 20% to 24% compounded — high enough to be attractive, low enough not to trip the alarms that a "10x your XRP" promise would. Staking was the wrapper: a familiar, technically legitimate-sounding mechanism that lets a fraudster explain why money must be sent somewhere and locked up.

What makes this case worth reading closely is the distribution, not the code. Police say the operators did not build a novel exploit; they built credibility. They took the name of a real blockchain project — Flare Network, which has genuine roots in the XRP ecosystem — and pushed the fake site through Naver blogs, online news articles, Wikipedia and YouTube. In other words, the fraud was an SEO and content-marketing operation. A prospective victim who did the thing everyone is told to do — search the project name, read a few articles, check the wiki — would have found corroboration the scammers themselves had planted.

Police told Chosun the fraudulent investment site ran from Oct. 16 to Oct. 23. That is an eight-day window for 71 victims and 3.4 million XRP. It also means the site almost certainly closed before the first promised monthly payout ever came due — the yield never had to be faked, only advertised.

The numbers, and where they diverge

The $8.5 million figure is what investigators say they have established. Both outlets report that police believe the true total is higher — as much as $19 million worth of XRP, per Chosun via CoinDesk, with CoinDesk's own summary phrasing it as "nearly $20 million." That is a proven-versus-suspected gap of more than double, and the higher number is a working investigative estimate, not a charged amount.

One arithmetic point the coverage does not make: 3.4 million XRP at $8.5 million implies about $2.50 per XRP, roughly where the token traded during the 2025 period in question. Decrypt's own price ticker on the day of publication showed XRP at $1.062. At that level the same 3.4 million tokens would be worth closer to $3.6 million. The headline dollar figure describes what was taken then, not what the coins are worth now — and the same caveat applies to the $19 million estimate.

Key facts

• 3.4 million XRP taken from 71 investors, worth about $8.5 million at the time — Seoul Metropolitan Police, via Chosun, reported by CoinDesk and Decrypt.
• Police believe the total may reach roughly $19 million in XRP — Seoul police via Chosun (CoinDesk).
• Promised returns of 1.5%–1.8% per month — police account via Chosun.
• Site operated Oct. 16–23 — Cyber Crime Investigation Unit, Seoul Metropolitan Police, via Chosun.
• Two suspects detained on aggravated fraud charges; arrest warrant issued and Interpol Red Notice requested for a third, location overseas and unknown — Korea JoonAng Daily via CoinDesk.
• Promotion ran through Naver blogs, news articles, Wikipedia and YouTube — police via Chosun.
• Flare Network reported more than $160 million in total value locked and over 887,000 active addresses as of late March 2026 — figures relayed by CoinDesk without a named source.
• Chainalysis estimated as much as $17 billion in crypto lost globally to scams and fraud in 2025, published January 2026.

The real-world read

"$8.5 million" and "$19 million" are not the same kind of number. One is what police say they can prove; the other is what they suspect. Both appear in the same headline paragraph across the coverage, and CoinDesk's summary rounds the suspicion up to "nearly $20 million." Readers should treat the larger figure as an open investigative claim from a party with an institutional interest in conveying the scale of what it is pursuing.

The dollar figure floats. Denominating a 2025 XRP theft in 2025 dollars is defensible, but the gap between $2.50 and the $1.06 on Decrypt's own ticker that day is large enough that it should have been stated. Neither piece does.

Flare's stats are unsourced. The $160 million TVL and 887,000 active addresses are project-health metrics with no attribution in the reporting. TVL and "active addresses" are also the two easiest numbers in crypto to flatter — TVL rises with token price alone, and address counts are not people. The description of Flare debuting in 2023 while "driving the development of real-world applications" is the project's own launch framing, and it reads that way. None of this implicates Flare in the fraud — the network is the impersonated party here — but the figures shouldn't be repeated as verified.

Nobody in the story speaks for Flare. Neither account contains a comment from Flare Network on the misuse of its name, whether it detected the fake site, or whether it reported it. That absence is conspicuous for a project whose brand was the load-bearing element of the scheme.

The distribution channels have not been held to account. Naver, Wikipedia and YouTube carried the promotional material that made the site look real. The coverage names them as vectors and stops there. There is no indication of takedown timelines, whether the planted Wikipedia edits survived, or whether any platform was asked about it.

A "zero-tolerance policy" is a quote, not a result. The police official's line, reported by the Korea JoonAng Daily, arrives alongside an unserved warrant, a suspect at an unknown overseas location, and a Red Notice that has been requested — not confirmed as issued. Nothing in the reporting says any XRP has been recovered or frozen.

Chainalysis is an interested party. Its $17 billion global scam-loss estimate is a proprietary blockchain-analytics figure from a firm that sells investigative tooling to exactly the kind of agency in this story. It is useful context; it is not an audited number.

Also worth noting: CoinDesk's page carried a promotional Binance case study alongside the article. That is marketing, unrelated to this case, and none of it informs the reporting above.

Opinion, and whose

• Seoul Metropolitan Police hold the view that the scheme is materially larger than the charged amount, putting the possible total near $19 million. That is an investigative belief, not an established fact.
• An unnamed Seoul police official, quoted by the Korea JoonAng Daily, said authorities "will strictly respond to cyber frauds involving cryptocurrency under a zero-tolerance policy," and urged caution toward unverified investment claims.
• Chainalysis argued in January that criminals are increasingly using impersonation and AI to industrialize victim targeting. This case — a real project's name, planted articles, a plausible yield — is consistent with that thesis, but a single prosecution does not confirm a trend.

Sources

• CoinDesk (July 30, 2026), "Fake staking site drains $8.5 million in XRP from dozens of investors promising easy yield" — the substantive account: victim count, XRP amount, promised monthly returns, operating dates, charges, Interpol request, Flare network stats, Chainalysis context. CoinDesk credits the South Korean outlet Chosun for the police detail and the Korea JoonAng Daily for the warrant, Red Notice and official quote. The page also displayed a promotional Binance case study; that is marketing and was not used.
• Decrypt (July 30, 2026), "Fake Flare Network Staking Site Drained $8.5M in XRP: Seoul Police" — corroborates the headline figures and the attribution to Seoul police; its live price ticker supplied the same-day XRP quote of $1.062 used in the valuation comparison above.
• Chosun and Korea JoonAng Daily — the originating Korean-language reporting, cited here as relayed by CoinDesk rather than read directly.
• Chainalysis, January 2026 — the $17 billion global scam-loss estimate. A commercial analytics vendor; treat as a proprietary estimate.

Nothing here is financial advice.