North Carolina couple’s life savings wiped out in massive XRP theft

A retired American named Brandon Laroque from North Carolina said more than $3 million worth of XRP disappeared from his Ellipal mobile app after he checked his balance on October 15 and found nothing ￰0￱ 54-year-old Brandon said this was his and his 60-year-old wife’s entire life savings, and they were planning to buy a house in Las ￰1￱ dream collapsed ￰2￱ said he had been building his XRP position since 2017, slowly selling pieces off to cover living costs. “That was everything we had,” he said. “I’m speaking up because maybe someone out there can learn from what happened to us.” He admitted he doesn’t expect the funds to be recovered, but hopes the story will remind people to keep their cold wallets truly ￰3￱ remained was everything they had left for ￰4￱ explained in a YouTube video released on Saturday that the theft likely happened on Sunday, October ￰5￱ small 10-XRP test transactions appeared around 11:15 ￰6￱ time, followed by a full sweep of about 1,209,990 XRP to a new ￰7￱ there, the funds were broken apart and moved across dozens of wallets in minutes, then hundreds more as the hours ￰8￱ smaller holdings, about $1,000 in XLM and $900 in FLR, were ￰9￱ realizing the funds were gone, he filed a report with the FBI’s Internet Crime Complaint Center and contacted local police, but he said it was hard to reach specialized cybercrime investigators quickly.

“I don’t know exactly how they got in,” Brandon said. “All I know is everything was there one day and gone the next.” Ellipal blames cold-to-hot wallet confusion Ellipal released a public statement on October 18 claiming its internal review showed that Brandon had entered his hardware wallet seed phrase into the Ellipal mobile app, turning what was supposed to be cold storage into a hot ￰10￱ an email to him, the company explained that when a seed phrase is imported into a phone or tablet, the device stores the private keys, connecting it to the internet and destroying the safety layer that makes a cold wallet ￰11￱ said he had the Ellipal app installed on both an iPhone and an ￰12￱ iPhone app had a blue background, which Ellipal told him represented a cold ￰13￱ iPad version showed an orange background, which meant it was ￰14￱ said that color difference mattered, emphasizing that their hardware devices are air-gapped, meaning they never connect to Wi-Fi, Bluetooth, or ￰15￱ company said no thefts had ever come from its physical wallets and insisted the incident looked like user error.

Still, the company admitted it couldn’t prove how the theft technically ￰16￱ said he simply followed the app’s interface. “If the blue means cold and orange means hot, why wasn’t that made clearer?” he said in one of his YouTube ￰17￱ hasn’t confirmed whether the color indicators failed or were misunderstood, but maintained that entering a seed phrase into an app immediately removes all ￰18￱ traces stolen XRP across Tron and OTC brokers On Sunday, on-chain sleuth ZachXBT posted a detailed thread on X (formerly Twitter) sharing how he identified the theft address by matching the transaction times and values shown in Brandon’s ￰19￱ his post, Zach said the attacker used Bridgers, the swap service previously called SWFT, to create more than 120 Ripple-to-Tron conversions on October ￰20￱ block explorers labeled the transactions as “Binance” because Bridgers routes its liquidity through the ￰21￱ to Zach’s X thread, the stolen XRP was eventually consolidated on the Tron network in a wallet labeled TGF3hP5GeUPKaRJeWKpvF2PVVCMrfe2bYw, before being sent to multiple over-the-counter brokers tied to Huione, a Southeast Asian marketplace flagged in ￰22￱ actions for handling illicit ￰23￱ days later, the funds had been reportedly scattered across countless addresses, making recovery practically ￰24￱ warned people to stay away from “crypto recovery” services, calling them scams that charge big fees for fake ￰25￱ said only fast reporting to legitimate investigators and compliant exchanges can sometimes help flag or freeze stolen funds.

“Once it’s bridged across chains and hits OTC desks, there’s almost no way back,” said ￰26￱ Bybit now and claim a $50 bonus in minutes