Updated 2026-06-14 · 7 min read · Guide

Is XORA Safe? How XORA Custody, Treasury, and Withdrawals Work

By XORA · Published · Updated

An honest look at XORA safety: custodial XRPL treasury, on-chain verifiable address, daily reconciliations, manual withdrawal review, panic-mode gates, and risks.

Short answer

XORA is a custodial XRP neobank, so you trust XORA to hold and return your XRP — it is not self-custody and not insured. Safety comes from a segregated, on-chain verifiable XRPL treasury, daily reconciliations, manual review for large withdrawals, panic-mode circuit breakers, and a public bug bounty. The headline 15% native XRP yield is currently subsidised by the XORA treasury during bootstrap and is temporary, not a guaranteed or risk-free return.

Open Xora Calculate XRP yield

What custodial means here

XORA pools user deposits into a single shared XRPL treasury wallet, and each deposit is routed by a unique per-user destination tag that maps it to your account. Your individual balance is an internal ledger record reconciled against the treasury's on-chain backing — it is not a separate on-chain wallet you control. This is custodial: you are trusting XORA to hold and return your XRP, the same trust model as an exchange or a crypto neobank, not a self-custody wallet.

On-chain verifiable treasury

Because the XRP Ledger is transparent, the treasury balance and settled treasury transactions are publicly queryable. The active treasury address is rhbErkS2d4H82tRbdGyFkhhc4LNtjKaC3o, viewable on any XRPL explorer such as livenet.xrpl.org, xrpscan.com, or bithomp.com. Individual user balances and the aggregate user-owed ledger are internal accounting records reconciled against treasury backing, so they are not independently visible on XRPL and can temporarily diverge during settlement, yield distribution, or operational holds.

Operational controls

Outbound movement is gated by restricted operational flows, per-IP rate limits, health checks, manual withdrawal review for high-risk outflows, and panic-mode circuit breakers that can freeze all yield distribution and outbound flows during an incident. Approved withdrawals re-run anti-drain, active-freeze, and treasury-availability checks immediately before submission. The treasury is reconciled daily — the sum of user ledger balances is compared against the on-chain treasury balance. A 3-of-5 XRPL multisig migration is on the custody roadmap and should not be treated as live custody until the signer list is published on-chain.

Public bug bounty

XORA runs a responsible-disclosure program at security@xora.finance with a 48-hour acknowledgement target. Critical findings such as direct fund loss, mass user impact, or auth bypass with privilege escalation qualify for rewards of $5,000–$25,000, with lower tiers down to $50–$250 for minor issues, paid in USDC or XRP. Third-party services (Clerk, Plaid, Vercel), social engineering, and physical attacks are out of scope.

Honest risk disclosure

XORA is custodial, so platform custody and treasury management are the core risks. It is not FDIC or SIPC insured — crypto custody is not deposit-insurance eligible. A 5% revenue depositor reserve is planned but is not funded or live today, and it is a finite buffer, not a guarantee. The 15% native XRP yield is currently a temporary treasury subsidy and will step down as TVL grows. XRP itself is volatile and its value can fall. Crypto involves risk, including total loss.

⚠ Tag required

Always include the destination tag with your XRP deposit. Without it the funds cannot be credited to your account automatically and recovery requires manual support intervention.

Checklist

  1. Open the public treasury address rhbErkS2d4H82tRbdGyFkhhc4LNtjKaC3o on an XRPL explorer such as livenet.xrpl.org.
  2. Read the security page to understand custody, reconciliation, and panic-mode controls.
  3. Read the yield-source page so you know the 15% native yield is a temporary treasury subsidy.
  4. Send a small test deposit with your destination tag before committing a larger balance.
  5. Run a full withdrawal back to a wallet you control before scaling up.

Frequently Asked Questions

Is XORA safe?

XORA is a custodial XRP neobank with a segregated, on-chain verifiable XRPL treasury, daily reconciliations, manual withdrawal review, panic-mode circuit breakers, and a public bug bounty. It is not self-custody and not insured, so the core risk is platform custody and treasury management. No crypto yield product is risk-free.

Is XORA insured or FDIC protected?

No. XORA is not a bank and is not FDIC or SIPC insured — crypto custody is not deposit-insurance eligible anywhere. A 5% revenue depositor reserve is planned but is not funded or live today, and it would be a finite buffer rather than a guarantee.

Can I verify XORA's treasury on-chain?

Yes. The treasury address rhbErkS2d4H82tRbdGyFkhhc4LNtjKaC3o is publicly viewable on XRPL explorers such as livenet.xrpl.org, xrpscan.com, or bithomp.com. Individual user balances are internal ledger records reconciled against that treasury backing, so they are not separately visible on-chain.

Is the 15% XRP yield guaranteed?

No. The 15% native XRP yield is currently subsidised by the XORA treasury as a temporary bootstrap mechanism. It is openly disclosed as temporary, will step down as TVL grows, and is not a guaranteed or risk-free return.

What happens if XORA is hacked or shuts down?

XORA reduces custody risk with a segregated treasury, restricted operational access, 24/7 monitoring, manual review for high-risk outflows, and panic-mode circuit breakers. In an orderly shutdown XORA reconciles the internal ledger against the on-chain treasury and coordinates withdrawals; the on-chain treasury history remains public regardless, but XORA is still a custodial product, not a self-custody wallet.

Sources

Next

Open XORA to view your live XRP balance, deposit address, destination tag, and yield projection.

Open Xora

Related guides

Compare XORA

Learn more