RLUSD on the XRP Ledger: 99.6% of its payments were 110 bots
Cross River Bank said on 15 October 2026 that RLUSD, Ripple's dollar stablecoin, now runs inside its core banking system on the XRP Ledger. Accounts on X answered with the ledger's payment count. We went through every RLUSD payment since August to see who was sending them.
- 99.6%
- 110
- 45%
- $648
- 14,600
01 · The claimA bank, a stablecoin, and a payment count
Cross River Bank is a New Jersey bank that runs the plumbing for fintech apps. On 15 October 2026 it said it had built RLUSD into its core banking system. RLUSD is the dollar stablecoin Ripple issues, and settlement runs on the XRP Ledger. Reports of the launch say eligible businesses can move between dollars and RLUSD through one API, at any hour.
XRP accounts on X took it from there. One widely shared post put it as "XRP will bridge every RLUSD transaction." Others posted the ledger's RLUSD payment count, which had climbed past half a million a day in late September. The number is real. The question is who sent it.
Bitquery indexes the XRP Ledger, the same data behind our count of who actually uses the XRP Ledger. We pulled every RLUSD payment between two different accounts from mid August to the day of writing, then sorted them by size, by sender and by receiver.
02 · The countHalf a million payments a day, almost all of them dust
RLUSD payment counts on the ledger look like a success story. In mid August they were a few thousand a day. By late September they were above half a million a day. Then, on the day of the bank's news, they fell off a cliff.
Sort those payments by size and the story changes. In the thirty days to mid October, almost every RLUSD payment on the ledger was worth less than a dollar. Most were worth about a tenth of a cent.
| RLUSD payments, 19 September to 18 October 2026 | Count |
|---|---|
| All RLUSD payments between two accounts | 7,821,066 |
| Under 1 RLUSD | 7,806,466 (99.8%) |
| Paid to the three collector wallets | 7,789,341 (99.6%) |
| RLUSD those 7.79 million payments carried in total | 7,722 RLUSD |
| Payments of 1 RLUSD or more | 14,600 (0.19%) |
| Peak day, 26 September | 573,589 payments, 388 of them 1 RLUSD or more |
Seven and a half thousand dollars, spread across nearly eight million payments. That is the whole of the headline number.
03 · The bots110 wallets, three sinks, one funding source
Dust is crypto's word for a payment too small to matter. On other chains it is usually a scam, like the address poisoning that pads Polygon's USDT0 holder count. This dust is different. Nobody here is a victim. The payments go to three wallets that belong to the same crew.
The senders are a cluster of 110 wallets. They pay about once every forty seconds each, around the clock, with no destination tag and no memo. The amounts are random fractions of a cent. The receivers are three collector wallets, and one of them took nine in every ten of the payments.
| The dust cluster | What the ledger shows |
|---|---|
| Sender wallets paying the collectors, 30 days | 110 |
| First collector, rBi1QrVjwaNofisZAQnovoXdHkS73FG1tJ | 7,050,565 payments, 22 September to 15 October |
| Second collector, ra9b6JX5aPVbdJhogDDddsRAcasWg7gzC3 | 470,120 payments from 5 October, still running |
| Third collector, rMPwy3Ntx56Nyc2fKGNm7VRWdmpHSB92Z7 | 16,083 payments |
| Average payment | 0.00099 RLUSD, about a tenth of a cent |
| Payments to the three collectors since the first on 9 June | 10,988,767, carrying 11,054 RLUSD in total |
| Fees paid by the cluster, 30 days | 495 XRP for 8,602,917 transactions, about $648 |
| XRP dust sent by the same cluster, 30 days | 807,939 payments of 0.002 XRP to 211 wallets |
We checked that the dust is the real token. Every one of the payments we sampled carried RLUSD issued by rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De, the address Ripple publishes as the RLUSD issuer. Look-alike tokens with the same three-letter code exist on the ledger, but they are not what the bots are moving.
Where did the wallets come from? All of them were set up the same way. Each got a few XRP to cover the account reserve and fees, then a few RLUSD to send. The XRP came from six wallets that Bitquery's labels, drawn from Binance's published proof-of-reserves list, mark as Binance. The RLUSD came from one of those six. The pattern is a Binance customer withdrawing to fresh wallets, over and over.
| How the cluster was funded and emptied | What the ledger shows |
|---|---|
| XRP into the bot wallets, from six Binance-labeled wallets | 810 payments, 5,419 XRP, 20 June to 18 October |
| RLUSD into the bot wallets, from rDAE53VfMvftPB4ogpWGWvzkQxfht6JPxr (Binance-labeled) | 1,431 payments, 13,341 RLUSD, 109 wallets |
| First collector out to rNxp4h8apvRis6mJf9Sh8C6iRxfrDWN7AV, all with destination tags | 138 payments, 12,925 RLUSD |
| That deposit account, last 60 days | 14,657 senders under 47,213 destination tags, every payment forwarded to the same Binance-labeled wallet |
The money goes back the same way. The first collector sweeps what it gets, with a destination tag, into one wallet. That wallet takes tagged payments from thousands of senders under tens of thousands of tags, and forwards everything to the same Binance-labeled wallet that funded the bots. That is the shape of an exchange deposit account. Whoever runs the cluster withdraws from Binance, spams the ledger, and deposits the dust back into Binance.
For three weeks the spam was a large share of all the ledger's traffic, in any currency.
The cost is small. The XRP Ledger charges a base fee of ten drops, a hundred-thousandth of an XRP, and raises it only when the network is busy. A month of the cluster's traffic cost it a few hundred dollars in fees. That is the price of making RLUSD look like the busiest token on the chain.
04 · The switch-offThey stopped the day of the announcement
The cluster wound down in three steps over 34 hours, rather than all at once. Each step was a group of wallets going quiet.
| Time, UTC | What happened |
|---|---|
| 14 October, 17:00 | First collector's inflow drops from 8,200 an hour to 1,200 |
| 15 October, 03:44 | Last payment ever to the first collector |
| 15 October | Cross River Bank announces the RLUSD integration |
| 15 October, 17:00 | Third collector starts taking about 50 payments an hour |
| 16 October, 03:00 | Second collector's inflow drops from 1,600 an hour to 11 |
| 17 October onwards | About 2,000 RLUSD payments a day, about 60 an hour of them still dust |
We looked for a reason on the ledger and found none. The fee the bots paid did not change before the first step; most of their transactions paid the base ten drops right up to the end. The ledger had no fee spike and no amendment that day. The wallets were not emptied. The crew turned the bots down, then off, on the day the bank made its announcement, and left a trickle running.
We do not know why. The timing could be a coincidence, or the crew could have been watching the same news as everyone else. The ledger records what happened and when, and nothing more.
05 · The real network14,600 payments, and ten wallets sent most of the money
Strip out the dust and RLUSD on the XRP Ledger is a different kind of thing. It is a settlement rail for a small number of large players, moving big round sums a few hundred times a day.
| RLUSD payments of 1 RLUSD or more, 19 September to 18 October 2026 | Value |
|---|---|
| Payments | 14,600 |
| Distinct senders / receivers | 1,826 / 1,536 |
| Senders that moved $10,000 or more in the month | 184 |
| Senders that moved $1 million or more in the month | 50 |
| Total moved, genuine issuer only | $7.33 billion |
| Of which in payments of $1 million or more | $6.98 billion in 828 payments (95%) |
| Sent by the ten largest senders | $6.05 billion (82%) |
| Median payment | 150 RLUSD |
| Issuer mints / redemptions | $728 million in 97 payments / $744 million in 68 payments |
The median payment, the one in the middle when you line them all up by size, is 150 RLUSD. The money sits at the other end. Payments of a million dollars or more are six in a hundred by count and nineteen in twenty by value.
Three of the ten are Ripple's own plumbing. The issuer, rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De, pays newly minted RLUSD to one wallet, r9c6A65SmhhZALrkMTpqc9X3kGjv5gtNNk. It takes redeemed RLUSD back from another, rGpaXxcBQFCkELhqnHbrascpPDdxSbNqxA. Both directions ran to about three quarters of a billion dollars in the month. That is RLUSD being minted and redeemed, and it is a fifth of all the value that moved.
| The issuer's loop, 19 September to 18 October 2026 | Amount |
|---|---|
| Issuer to its mint wallet, r9c6A65SmhhZALrkMTpqc9X3kGjv5gtNNk | $728 million in 97 payments |
| Redemption wallet rGpaXxcBQFCkELhqnHbrascpPDdxSbNqxA to the issuer | $734 million in 67 payments |
| Everything paid to the issuer, two senders | $744 million in 68 payments |
| Share of all RLUSD value moved | a fifth |
Five more take tagged deposits. The largest, rLoD9U2ghXP2xUYbtML6G6v1p8LhM9mSnc, gets almost every incoming payment with a destination tag. It sent most of its $865 million out to the redemption wallet and to two other tagged accounts. That is how an exchange or a custodian runs a shared deposit address. None of the five carries a label in Bitquery's data, so we describe them and name nobody.
One pair is odd. rnhSfmKMuj4CTRKNVMUZ8koHPZCMSCQfv3 received $424 million from r39TAwuqkA5BNxxfL5YXewRGtCgBcADjcx, and sent every dollar of it straight back, in the same number of tagged payments each way. It has no other counterparty. Two wallets passing the same money to and fro add twice that sum to the ledger's RLUSD volume without anyone being paid.
So the real RLUSD network on the XRP Ledger in a month is under two thousand sending wallets, and fewer than two hundred of them moved more than ten thousand dollars. The big money moves between the issuer, a handful of exchange-shaped deposit accounts and Binance. That is a working settlement rail. It is nothing like half a million payments a day.
06 · The answerWhat the payment count is worth
Cross River's integration is new, and the ledger cannot yet show what it will carry. What the ledger can show is what the RLUSD payment count was made of on the day the bank announced it. For a month, all but a few in every thousand RLUSD payments were a tenth of a cent, sent by a bot to its owner, paid for with about twenty dollars a day in XRP fees.
Payment counts are easy to pad, the same way holder counts get padded on other chains. The cheaper the chain, the cheaper the pad. On the XRP Ledger a payment costs a hundred-thousandth of an XRP, so one person with a Binance account and 110 wallets can be half the chain's traffic for a month.
For a stablecoin, the number to watch is the money. In a month, more than seven billion dollars of RLUSD moved on the XRP Ledger in payments of a dollar or more, through fewer than two thousand wallets. That is the base the bank is building on. It is real, it is large, and it has nothing to do with the number on X.
A payment is an XRP Ledger Payment between two different accounts that delivered RLUSD, the currency code 524C555344000000000000000000000000000000. Trades, account deletions, escrows and self-payments are left out. Failed transactions never count.
Dust means a payment that delivered less than 1 RLUSD. The cluster is the set of wallets that paid one of the three collector wallets in the 30-day window. The 110 wallets are tied together by their shared receivers and their shared funding, not by any statement from whoever runs them.
The currency code is shared by every issuer that uses it. The 14,600 real payments were checked against the issuer in Bitquery's XRP Ledger payment records: 14,578 carried RLUSD from rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De and 30, worth $38.6 million in name, carried look-alike tokens. The dollar totals here use only the genuine issuer. Dust payments were checked on a sample of one sender for one day, all of which were genuine.
Labels come from Bitquery's address labels, which for the XRP Ledger cover mainly the proof-of-reserves wallets exchanges publish. Binance is named because six funding wallets carry that label. Every other wallet is described by its behaviour and attributed to nobody. A wallet that takes tagged deposits looks like an exchange or custodian; we do not say which.
Dollar figures treat one RLUSD as one dollar. XRP is priced at $1.31, Bitquery's valuation price on 19 October 2026.
The link between the shutdown and the Cross River announcement is a matter of timing on the ledger. Nothing here says who knew what, or why the bots stopped.
07 · The recordAddresses behind this story
FAQ
How many RLUSD payments are there on the XRP Ledger?
Nearly eight million in the thirty days to mid October, and all but 14,600 of them were dust of about a tenth of a cent, sent by a cluster of bot wallets to three collector wallets.
What is RLUSD?
RLUSD is Ripple's dollar stablecoin. It is issued on the XRP Ledger from the address rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De and also on Ethereum. One RLUSD is meant to be worth one US dollar.
What did Cross River Bank announce?
On 15 October, Cross River Bank said it had built RLUSD into its core banking system, with settlement on the XRP Ledger, so that eligible fintech businesses can move between dollars and RLUSD through the API they already use. The service is starting in selected US states.
Did the bots stop because of the announcement?
We cannot tell from the ledger. The first collector's inflow dropped on the evening of 14 October UTC and stopped in the early hours of 15 October, the day of the announcement. The second stopped a day later. Nothing on the ledger, such as a fee spike or an amendment, explains the timing.
Who ran the dust bots?
We do not know. All 110 wallets were funded from wallets that Binance lists in its proof-of-reserves, and the collector sweeps the dust into a deposit account that forwards to the same Binance wallet. The pattern fits one Binance customer rather than Binance itself.
How much real RLUSD moves on the XRP Ledger?
In the same thirty days, about seven billion dollars moved in payments of a dollar or more, through fewer than two thousand sending wallets. Ten wallets sent four fifths of it, and about a fifth is the issuer minting and redeeming RLUSD.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell, or hold any token or asset.
The findings describe payments observed in XRP Ledger data between 15 August and 19 October 2026, together with the rules used to sort them by size, sender and receiver. The 110-wallet cluster is an inference from shared receivers and shared funding. Attributions come from Bitquery's address labels and on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available. XRP Ledger addresses are pseudonymous, and an unlabeled address is described by its behaviour and attributed to nobody.
References to Ripple, RLUSD, Cross River Bank, Binance or any other named party describe on-chain records and public statements, and are not statements about any entity's conduct, solvency or intentions. The timing of the shutdown is reported as the ledger records it; nothing here asserts that any named party caused it, knew of it, or acted unlawfully.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Divyasshree for Bitquery Research, with AI tools; every figure was checked against the raw data.
Check the XRP Ledger's numbers yourself
The figures above come from Bitquery's XRP Ledger data, which holds every payment back to the first ledger in 2013. You can look up any address named here through our API, or follow where a wallet's money went with the Bitquery MCP, which is how this cluster was traced.