A North Carolina man has lost over $3 million worth of XRP, representing his retirement savings, to hackers. The incident, which occurred on October 15, highlights the critical importance of understanding and correctly implementing cryptocurrency security measures, even with cold storage solutions.
Key Takeaways
-
A crypto investor lost 1.2 million XRP, valued at over $3 million, due to a security lapse.
-
The loss is attributed to importing a cold wallet's seed phrase into a hot wallet.
-
On-chain sleuth ZachXBT traced the laundered funds through multiple exchanges and OTC desks.
-
Ellipal, the wallet provider, clarified that its cold wallet was not compromised.
The Devastating Loss
Brandon LaRoque, a cryptocurrency investor since 2017, meticulously accumulated 1.2 million XRP over eight years, storing it in what he believed was an Ellipal cold wallet. Despite adhering to standard security practices, including safeguarding his seed phrase and avoiding suspicious communications, he discovered on October 15 that his entire XRP holdings were gone.
LaRoque's investigation revealed that the attackers initiated the theft with a small test transaction of 10 XRP to a newly created wallet. Shortly after, they transferred the remaining 1,209,000 XRP to over 30 new wallets. These funds were then rapidly fragmented into hundreds of smaller wallets. Notably, other assets in his wallet, including Stellar (XLM) and Flare (FLR) tokens, were left untouched.
The stolen XRP represented LaRoque's retirement plans, which included purchasing a home in Las Vegas. He expressed some relief that he had also invested in precious metals, though these holdings were significantly smaller than his crypto investments.
Unraveling the Hack
On-chain investigator ZachXBT shed light on the incident, suggesting it stemmed from a user error. ZachXBT explained that LaRoque mistakenly believed he was using the cold version of the Ellipal wallet when, in fact, he had imported his cold wallet's seed phrase into a hot wallet. This action exposed the funds to online threats.
ZachXBT's analysis indicated that the attackers executed over 120 XRP to Tron swaps via Bridgers (formerly SWFT) on October 12, 2025, utilizing Binance for liquidity. Following this mixing process, the consolidated funds were moved to a Tron wallet. The funds were eventually laundered through Huione-associated OTC desks in Southeast Asia on October 15, a platform known for handling illicit financial activities.
ZachXBT also noted that the chances of recovering the stolen funds are slim due to delays in reporting the incident.
Ellipal's Response and Security Advice
Ellipal issued a statement on X (formerly Twitter) to clarify that its cold wallet technology was not breached. The company explained that LaRoque compromised his own security by importing his cold wallet's seed phrase into an online-based hot wallet, making the funds vulnerable. Ellipal confirmed it is supporting LaRoque and cautioned other users against similar practices.
Both Ellipal and ZachXBT emphasized the importance of keeping recovery phrases and storage devices completely offline. They also advised victims of crypto theft to report incidents promptly to relevant private sector entities to aid in potential fund recovery efforts.
Sources
-
North Carolina Man Loses 1.2M XRP Retirement Savings to Hackers, The Crypto Basic.
-
Hackers siphon $3 million in XRP from US user's wallet: ZachXBT, The Block
-
Hackers siphon $3 million in XRP from US user’s wallet: ZachXBT, TradingView
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.