Ripple CTO warns of Robinhood phishing emails abusing real email infrastructure

Ripple CTO Emeritus David Schwartz warns of Robinhood phishing emails that used the exchange’s real email sending path, allowing messages to pass common domain authentication checks. The scam begins with a subject like “Your most recent login to Robinhood,” claiming an unrecognized login (e.g., “iPhone 17 Pro”) and pushing a high-pressure “Review Activity Now” button with panic language about irreversible changes. Schwartz says the key issue was the fraudulent injection into a legitimate delivery flow, making the phishing emails look authentic. Robinhood later confirmed the incident, attributing it to abuse of its account creation flow rather than a breach of its systems, and stated no personal data or funds were exposed. Its guidance: delete the email, do not click links, and contact support via the app. For crypto traders, this is primarily an operational risk headline: recurring phishing campaigns can increase account-compromise events, which may amplify volatility around heavily used platforms/wallets during major news cycles. Similar tactics have affected Ledger users and have been reported as rising in crypto—via wallet poisoning and fraudulent approvals.