Every crypto community eventually learns the same hard lesson: the technology that makes a public ledger powerful - irreversible, permissionless, instant - is exactly what makes it a paradise for thieves.

The XRP community has learned this lesson ... many times over.

The playbook is familiar to anyone who has spent time in XRP or XRP Ledger circles. A phishing site mimics a wallet login. A fake "support agent" reaches out after someone posts about a problem. A giveaway scam promises to double any XRP sent to a "verification" address. A malicious memo tricks a holder into approving a transfer.

Case Files

In one recent case, an XRP holder lost roughly $16,800 after receiving a payment request with a memo reading "Safe XRPL verify message" - deceptively official-sounding, entirely fake. In another, a compromised hardware wallet led to a $3 million XRP theft, with the stolen funds bridged across chains and laundered through exchanges.

The Challenge For Volunteers

Once the funds move, the pattern is almost always the same: the attacker doesn't sit still. Stolen value gets split across dozens of freshly created "mule" accounts, hopped through several intermediate wallets, and sent to an exchange that will convert it to cash before anyone can react.

Every hop is designed to break the trail, or at least slow down whoever's trying to follow it.

For years, stopping this has depended almost entirely on volunteers. Blockchain explorers like XRPScan let victims flag a scam address so others get a warning. Independent forensics teams - community-run efforts like EXFILAI, Xahau Forensics, and other well-known on-chain investigators - trace stolen funds hop by hop and publish what they find. When the money reaches a known exchange, someone has to convince that exchange's support team to freeze the account before the attacker cashes out.

None of this is automatic, and none of it is guaranteed to happen before the money's gone. 🤨

This is the gap that a new project called Odin's Eyes is trying to close - not by making theft impossible, but by making the response to it automatic.

Xahau

To understand how Odin's Eyes works, it helps to understand Xahau.

Xahau is a network built from the same open-source code as the XRP Ledger (XRPL), extended with a feature the XRPL itself doesn't have: hooks. A hook is code - compiled to WebAssembly - that attaches directly to an individual account.

Xahau Account And Hook Smart Contracts

Once installed, a Hook can inspect every transaction touching that account and decide, in real time, whether to allow it, modify it, or reject it. It can also remember things between transactions, and can trigger new transactions on its own.

On many networks, "smart contract" logic lives in its own separate contract and has to be called deliberately. On Xahau, a Hook effectively becomes part of the account it's installed on - every payment in or out passes through it automatically, the way a bank's fraud-detection system reviews every transaction on your card before it clears.

That capability - a small, autonomous checkpoint on every transaction - is exactly what a "whitelist/blacklist" security system needs.

Blacklist And Whitelist

If an account can check every incoming and outgoing transaction against a list of known-bad addresses and block anything involving them, you have the beginning of a real defense system, built directly into the ledger. This general idea - using hooks to enforce an allow/deny list - has circulated in the Xahau developer community since the platform's early days, including a mention in the very original Xahau whitepaper.

Odin's Eyes is the most complete, live realization of this concept to date.

Odin's Eyes

Odin's Eyes was built - by the creator of "One Xahau" - as an evolution of that whitelist/blacklist idea into a full protocol; a shared registry that any Xahau account or product can plug into, rather than every project maintaining its own private blacklist.

At its core, Odin's Eyes is simple, even though its branding leans heavily on Norse mythology. One account - nicknamed "the Eye" - keeps a single status for every address it has judged: clean, verified, suspicious, or confirmed malicious.

Odin's Eyes Agentic Security Protocol

Other Xahau accounts install a small companion Hook - nicknamed a "raven" - that checks every visitor against that shared status before allowing a transaction through. If the Eye later marks an address as bad, every raven that's watching for it freezes it, automatically, without anyone pushing an update.

Decoding The Mythology

The poetic names are memorable, but they map cleanly onto ordinary technical components. Here's the translation:

Stripped of the poetry, it's a shared reputation registry with automatic, network-wide enforcement.

Worst Case: The Scammer Scenario

To see why that matters, walk through a theoretical case.

An attacker compromises a wallet and drains it of one million XAH, immediately splitting the stolen funds across a dozen freshly created accounts to obscure the trail - the same "mule fan-out" pattern seen in real XRP thefts.

In a world without Odin's Eyes, the victim (or a volunteer investigator) now races the clock: manually tracing each hop, hoping to identify the destination exchange before the funds are converted to cash and withdrawn.

Racing Scammers

In an Odin's Eyes–enabled ecosystem, the response looks different. As soon as the theft is reported, a council member - a trusted, wallet-holding participant - flags the attacker's address, signing the action from their own device.

That single verdict writes to the registry.

Then, every raven installed on a connected product - a DEX, a lending protocol, a token issuer - checks against it. The next time the attacker's account (or any of its freshly spawned mule accounts) touches a guarded product, the raven doesn't just block that one transaction; it also checks who funded that mule account, discovers the link back to the flagged attacker, and reports that connection back to the registry. The registry re-judges, and the mule inherits the same bad status. As the stolen funds keep moving to try to stay ahead of detection, they keep tripping this same mechanism - and the "bad" label spreads through the entire tree without anyone having to manually trace each branch.

If the attacker's address is escalated to a full blacklist, any product with a raven installed and a matching issued token freezes that holder's trustline immediately - even before the attacker touches that particular product - because the freeze order is broadcast the moment the blacklist decision is made.

NOTE: The goal isn't to reverse a completed theft (Xahau, like the XRPL, doesn't allow that); it's to freeze the stolen funds in place before they reach a cash-out point, turning what used to be a slow, manual chase into something closer to an automatic circuit breaker.

No More Volunteers

None of this works for long if the people doing the watching aren't compensated for their time. This is where Odin's Eyes' reward token, RVN, comes in.

Anyone can install a raven on their own account, but to have it actively report threats and earn rewards, the operator buys a one-time raven license, paid for in RVN and permanently burned (destroyed) as part of the purchase.

From there, a raven earns RVN in two ways.

• A small, steady baseline reward accrues just for actively screening traffic, even if it never finds anything suspicious - this exists specifically to avoid a common failure mode in security incentive systems, where operators only get paid for catches and lose interest the moment an ecosystem is quiet.
• On top of that baseline, a larger bounty is paid out for reports that are later confirmed as genuinely malicious, with an extra reward for whoever spots a threat first.

The total supply of RVN is hard-capped at 100 million, released gradually over time on a halving schedule similar in spirit to Bitcoin's. Reputation earned by a raven - which determines both its share of rewards and, eventually, its voting power over the system's detection settings - can only be built through confirmed, legitimate catches; reputation decays if a raven goes idle, so old activity can't be banked indefinitely to farm rewards later.

Instead of relying on volunteers who investigate scams for free, out of goodwill, Odin's Eyes tries to build a sustainable, paid workforce of automated watchers with a direct financial stake in catching real threats - and a built-in penalty (decay) for not doing the job well.

What's Next

As of this writing, Odin's Eyes is live on the Xahau mainnet, with a small footprint: a public blacklist and soft-flag list, a handful of active ravens run by early participants, and a public read API that any developer can query for free.

Now that the project is available for public participation, enhancing broader adoption through its listing on One Xahau is in progress, alongside the the other tokens integrated with that platform.

Learn More

The best way to understand Odin's Eyes in depth is to explore the site:

• odinseyes.io - the homepage, with a live look at current blacklist/soft-flag counts and active ravens
• The Tome (odinseyes.io/tome) - the full, current blacklist and soft-flag list, updated in real time
• The Protocol console (odinseyes.io/registry) - a live feed of on-chain activity between the Eye and its ravens
• The Chronicle - the project's own technical documentation, for readers who want the underlying architecture in detail
• The public API (odinseyes.io/api) - free, no-key-required access to the live blacklist, for developers who want to see the data firsthand

Automated ... And Incentivized

For as long as public blockchains have existed, defending their users from theft has fallen to volunteers: people who traced stolen funds on their own time, with the sole reward of helping others. It has worked often enough - but it has rarely worked fast enough.

Odin's Eyes doesn't solve crypto crime.

It can't undo a theft, and it only protects the corner of the ecosystem that chooses to install it. But it has something the volunteer model never did: a system where flagging a threat is rewarded, and where a single verdict, once reached, enforces itself instantly, everywhere at once. X>

Sources

XRP Scan: https://docs.xrpscan.com/faqs/how-to-report-scams

EXFILAI 'X' Account: https://x.com/EXFILAI

Xahau Forensics 'X' Account: https://x.com/EXFILAI

Xahau Network - https://xahau.network/

Xahau Hooks documentation - https://docs.xahau.network/features/network-features/hooks

https://github.com/Xahau/Whitepaper/blob/main/Xahau-Whitepaper.pdf

'X' Live Space on July 5, 2026 https://x.com/i/spaces/1AGRnnyBeEPGl?s=20

Odin's Eyes - https://odinseyes.io/

One Xahau - https://onexah.io/

XRPL.org, "Report a Scam" - https://xrpl.org/community/report-a-scam

The Block, "Hackers siphon $3 million in XRP from US user's wallet: ZachXBT" - https://www.theblock.co/post/375252/hackers-siphon-3-million-in-xrp-from-us-users-wallet-zachxbt

U.Today, "XRP Community Targeted in New Scam Exploiting Fake Verification Messages on XRP Ledger" - https://u.today/xrp-community-targeted-in-new-scam-exploiting-fake-verification-messages-on-xrp-ledger