North Carolina Retiree Loses $3 Million in XRP After Wallet Breach

Highlights:

• A retired man from North Carolina lost over $3 million in XRP overnight.
• The hacker moved the stolen XRP through many wallets and swapped it for Tron.
• Ellipal said Brandon’s wallet turned hot when he entered his seed phrase in the app.

A retired man from North Carolina, Brandon Laroque, said that more than $3 million worth of XRP suddenly disappeared from his Ellipal wallet. When he checked his balance on October 15, he found the account completely empty. The 54-year-old shared that the lost amount represented all the savings he and his 60-year-old wife had. They had planned to buy a house in Las Vegas, but that dream collapsed overnight. 

“That was everything we had,” Brandon said. “I’m speaking up because maybe someone out there can learn from what happened to us.” He shared in a YouTube video on October 18 that the theft most likely happened on October 12. 

Around 11:15 a.m. Eastern time, two 10-XRP test transfers appeared, followed by a full sweep of 1,209,990 XRP to another wallet address. Within minutes, the thief divided the stolen coins and sent them through dozens of wallets, expanding to hundreds within hours. The attacker appeared to leave his smaller holdings, about $1,000 in XLM and $900 in FLR, untouched. 

ZachXBT: A U.S. user lost $3.05 million in XRP after their Ellipal hardware wallet was hacked. The stolen funds were moved via Bridgers and laundered through OTC channels tied to Huione, a Southeast Asian platform recently sanctioned by U.S. regulators for fraud and money…

— Wu Blockchain (@WuBlockchain) October 19, 2025

Brandon Seeks Answers After Reporting the Theft

Brandon quickly reported the theft to the FBI’s Internet Crime Complaint Center (IC3) and local police. But he said it was hard to reach the right investigators, and he still doesn’t know how the hacker got in. “Everything was there one day and gone the next,” he said. He shared that he’d been building his XRP savings since 2017, selling small parts over time to cover expenses. What was stolen was all that was left of their retirement money.

Ellipal Responds to the Theft Case

On October 18, wallet maker Ellipal released a statement after reviewing the case. The company said Brandon had entered his wallet’s seed phrase into the Ellipal mobile app, which made the device act as a hot wallet connected to the internet. Brandon said he used Ellipal on both an iPhone and an iPad.

The iPhone app had a blue background, which the company said meant cold storage, while the iPad app had orange, showing it was hot. “If the blue means cold and orange means hot, why wasn’t that made clearer?” he asked in his video.

Ellipal explained that a cold wallet remains safe only when its private keys are kept offline. When a seed phrase is entered on a mobile device, those keys are stored on that device, which removes all protection. The company stated that its hardware wallets have never been linked to any thefts and attributed the issue to user error. Ellipal said it could not confirm whether the color display was confused, but maintained that once a seed phrase is entered into the app, the wallet loses all offline protection.

We’ve been in direct contact with the user and have been doing everything possible to assist.
After investigating, we confirmed that the loss occurred because the cold wallet seed phrase was imported into the app, which turned it into a hot wallet.
ELLIPAL’s cold wallets remain…

— ELLIPAL (@ellipalwallet) October 19, 2025

On October 20, Ellipal said Brandon’s case shows why user education is so important. The company promised to create simpler guides and tutorials to help users stay safe. It also thanked the community for its support and said it will keep working to make crypto safer for everyone.

A Message to Our Community: Standing with Brandon LaRoque & Wallet Safety Awareness

We were saddened to learn that our U.S. user, @Blaroque , recently lost approximately $3 million worth of XRP — about 1.2 million XRP tokens in a hot wallet theft incident. Our hearts go out to… pic.twitter.com/KXFUPUKFX0

— ELLIPAL (@ellipalwallet) October 20, 2025

On-Chain Investigator Tracks the Stolen XRP

On October 20, blockchain investigator ZachXBT traced the stolen XRP through Bridgers (formerly SWFT), where the thief converted it to Tron in over 120 transactions. He said the funds passed through Binance liquidity and landed in a Tron wallet before being sent to Huione-linked brokers in Southeast Asia.

Within three days, the XRP was spread across many wallets, making recovery impossible. Zach warned against fake “crypto recovery” services, saying once funds reach OTC desks, they’re nearly impossible to trace. Brandon said he has accepted the loss and hopes others learn to keep cold wallets offline and handle seed phrases carefully.

1/ A video went viral on YT this week after a US based victim lost $3.05M (1.2M XRP) from their Ellipal wallet.

Here’s the tracing of where the stolen funds ended up and the biggest takeaways for similar thefts. pic.twitter.com/Gyw0OWjts4

— ZachXBT (@zachxbt) October 19, 2025