This is super suspicious. One, you’ve been in crypto for quite a while and you’re holding your $3 million in XRP? Per my understanding that was the property of a company handling international settlements and centrally controlled. The only cryptocurrency of value is Bitcoin due to the worldwide distribution of mining equipment outside the control of any one government, opensource nodes run by people distributed around the world outside the control of governments (you can compile and run your own), and cryptographically sound so no central authority is needed, nor capable of reversing transactions. And Bitcoin has significantly been gaining in value over time, so why would you be invested in XRP if you know crypto? One angle is this could be a setup for a donation scam? Or perhaps just a psyop to scare people away from self-custody, to use custodial wallets, and/or scare people away from cryptocurrencies altogether. Furthermore, he didn’t mention which Ellipal wallet, but they support over 10,000 cryptocurrencies, so you’d have to wonder how well vetted for each one. Furthermore, this Ellipal cold wallet company is based out of Hong Kong and has closed source software, humongous red flags. If he used the device to create the seed phrase there might be a problem with their random number generator making a seed phrase attack possible as China isn’t known for their quality. And maybe his wallet was intercepted and flashed with malware, and he didn’t put verified firmware on it? If you don’t know what you’re doing, use proper consultants to help pick hardware and train you on security practices.

There was an update and it appears he typed his seed phrase into the wallet app on an iPad turning it into a hot wallet and wiping out the value of the air-gapped cold wallet (article below). So was the iPad hacked for the seed phrase or was the hardware wallet compromised? So if you’re going to self-custody a substantial amount of cryptocurrency and you don’t know what you’re doing, find some security consultants to help you navigate crypto choice, hardware, and security best practices.

XRP Investor Says $3M in XRP Was Stolen; Cold Wallet Maker Says Seed Import Made Wallet Hot

Long-time XRP investor Brandon LaRoque says he discovered the loss on Oct. 15 in cold wallet maker Ellipal’s mobile app, but the theft occurred on Oct. 12.

By Siamak Masnavi, AI Boost | Edited by Aoyon Ashraf

Updated Oct 19, 2025, 12:01 p.m. Published Oct 19, 2025, 11:57 a.m.

What to know:

• He says he found the loss on Oct. 15 in the Ellipal app; the theft happened on Oct. 12.
• Ellipal told him that if you type a hardware wallet’s seed into the Ellipal app, the private keys are saved on your phone or tablet, turning it into a hot wallet.
• He says his iPhone app showed a blue “cold” view while his iPad showed an orange “hot” view, per Ellipal’s color cues.
• On-chain sleuth ZackXBT traced Oct. 12 swaps via a bridge to Tron and then to OTC venues.

An American retiree says more than $3 million in XRP vanished after he checked Ellipal’s mobile app on Oct. 15 and saw his balance gone, a discovery that spurred an on-chain tracing effort by pseudonymous analyst ZackXBT.

CoinDesk has not independently verified the investor’s identity, balances, or the complete on-chain path. The account comes from several YouTube videos posted since Oct. 15, Ellipal’s public statement on Oct. 18, and ZackXBT’s Oct. 19 X thread.

By signing up, you will receive emails about CoinDesk products and you agree to our terms of use and privacy policy.

What the victim says happened

The investor, who identified himself as Brandon, said he lives in North Carolina, is 54, and that his wife, 60, is also retired. He said the XRP position was almost their entire retirement savings and that they had planned to buy a house in Las Vegas.

He said he had been accumulating XRP since 2017 and previously held more but sold some for living expenses. In his YouTube videos, he said he discovered the theft by checking the Ellipal app on Wednesday, Oct. 15, and then determined the drain occurred on the previous Sunday, Oct. 12.

He described two 10-XRP test pulls around 11:15 a.m. Eastern time, followed by a sweep of about 1,209,990 XRP to a newly created address, then rapid fan-out across dozens of wallets and eventually hundreds. He said smaller balances of other assets, including roughly $1,000 in XLM and about $900 in FLR, remained.

He said he filed with the FBI’s Internet Crime Complaint Center and contacted local authorities, but struggled to reach specialized cyber units quickly. He said he does not know precisely how the funds were taken from the hot wallet.

Ellipal’s explanation and the cold-to-hot confusion

Ellipal said on Oct. 18 that its review indicated the user had imported the hardware wallet’s seed phrase into the Ellipal mobile app, which would recreate the wallet on an internet-connected device.

In an email to the user, Ellipal explained that if a cold wallet’s seed is used on a phone or tablet, the seed and resulting private keys would be stored on that device, effectively making it a hot wallet and greatly reducing security.

Brandon said he had Ellipal’s app on both an iPhone and an iPad. He mentioned that the iPhone app showed a blue background, which Ellipal told him denotes a cold-wallet connection, and the iPad app showed an orange background, which Ellipal told him indicates a hot wallet.

Ellipal emphasized that its hardware devices are air-gapped and said it has not seen thefts originate from the hardware itself. The company’s account points to user error, though it does not by itself prove how the compromise occurred.

Where the funds reportedly went, per ZackXBT’s investigation

In an Oct. 19 thread, ZackXBT said he identified the theft address by matching the video’s timing and amounts. He reported that the attacker created more than 120 Ripple-to-Tron orders on Oct. 12 using Bridgers, a swap service formerly known as SWFT. He noted that some block explorers label those hops as “Binance” because Bridgers uses the exchange for liquidity.

He said the funds consolidated on Tron at a wallet TGF3hP5GeUPKaRJeWKpvF2PVVCMrfe2bYw and by Oct. 15 were dispersed to over-the-counter brokers adjacent to Huione, an online marketplace in Southeast Asia that has been cited in recent public actions by U.S. authorities. CoinDesk has not independently reproduced the full tracing or confirmed the ultimate recipients.

Recovery odds and user takeaways

ZackXBT cautioned that most “recovery” firms are predatory, often producing superficial reports while charging high fees. He said quick reporting to credible investigators and compliant platforms can improve the odds of flags or freezes, but recoveries are rare once funds move through cross-chain swaps and OTC venues.

For users, the core lesson is straightforward: if the goal is cold storage, do not type a hardware wallet’s seed into a mobile or desktop app. Use a distinct seed for any hot wallet and consider a BIP39 passphrase for high-value cold storage.

Brandon said the loss wiped out what he considered the couple’s retirement plan. He said he shared his experience to warn others and to seek guidance, while acknowledging the chances of recovery are low.