A chilling episode has stroked the crypto
community: a U.S. investor believed his XRP holdings were safely locked away in a cold wallet, only to wake up and discover nearly 1.2 million XRP (worth around $3 million) had vanished. The twist? The “cold wallet” he trusted may have been, in fact, operating as a hot wallet. Here’s what happened — and the crucial warning that followed.
📌 What happened?
The investor, identified in coverage as Brandon LaRoque, a retiree from North Carolina, said he discovered the loss Oct 15 after checking his wallet. The theft itself is traced to Oct 12.
Two small 10 XRP withdrawals appeared first (apparently test transfers), followed by a sweeping transfer of ~1.2 million XRP to a new wallet, then rapid fan-out to dozens, then hundreds of addresses.
The victim said he’d been accumulating XRP since 2017 and that the sum represented his and his wife’s entire retirement savings – a house purchase in Las Vegas had been planned.
🧩 The surprising cause: Cold turned hot
The hardware wallet maker Ellipal (which markets an air-gapped cold wallet device) stated its review found the seed phrase was imported into the Ellipal mobile app, which meant the device effectively became a hot wallet (connected to the internet) rather than true offline cold storage.
Incidentally, the app shows different colour backgrounds: a blue background indicates the cold-wallet mode, while an orange background indicates hot-wallet mode – and the victim said his iPad showed orange (hot) although he believed he was using a cold wallet.
Ellipal emphasised their hardware device remains air-gapped with no WiFi/Bluetooth/USB, and said they have not seen thefts from the physical devices themselves — but the seed import into a mobile app removed the offline protection.
🔍 Where did the funds go?
Blockchain investigator ZachXBT traced the funds: the attacker used a bridging service (formerly SWFT, now called Bridgers) to convert XRP → Tron via ~120 bridge transactions, consolidated on Tron at address TGF3hP5GeUPKaRJeWKpvF2PVVCMrfe2bYw, then sent to OTC brokers tied to the platform Huione (recently sanctioned by the U.S. Treasury for illicit transfers).
The rapid cross-chain and OTC movement makes recovery very difficult — once funds hit such networks, tracing and freezing becomes complicated.#Ripple1BXRPReserve
⚠️ Key Takeaways & Warning
“Cold wallet” does not always mean offline: The core mis-step here was importing the cold-wallet seed into the app, which removed the air-gapped protection and exposed the holdings to online vulnerability.
If you hold significant crypto for long-term storage:
Use distinct wallets for hot and cold storage (do not repurpose the same seed for both).
Ensure the cold wallet seed remains only on the hardware device, never imported into mobile/desktop apps.
Watch for wallet UI cues (in this case, app colour background) and understand them.
Be cautious about “crypto recovery” firms: The incident also highlights a secondary risk — many firms offering recovery services often charge large fees and may deliver little. The same blockchain investigator warns that > 95% of such recovery firms may be exploitative.
Act quickly if you’re hacked: Filing with credible law-enforcement or regulators early and contacting compliant exchanges might improve chances, but success is far from guaranteed.
📝 Final word
This case is a sobering reminder: even when you think you’re doing everything right, a small misunderstanding (seed import, app confusion, UI cue) can lead to catastrophic losses. For the XRP community and self-custody users at large, the message is clear — review your wallet workflows, verify how your assets are stored, and don’t assume “cold wallet” automatically equals offline.

