- Trending
- Comments
- Latest
A single security mistake cost Brandon LaRoque everything. The 54-year-old North Carolina retiree lost $3 million in XRP—his entire retirement savings built over eight years—after entering his hardware wallet’s seed phrase into a mobile app, unknowingly converting his secure cold storage into a vulnerable hot wallet. By October 15, 2025, when LaRoque checked his balance, 1.2 million XRP tokens had vanished.
The theft, traced back to October 12, began with two small “test” transfers before the hacker swept the remaining 1,209,990 XRP. For LaRoque, who had spent eight years building his XRP retirement savings as a financial cushion for him and his wife, the loss was catastrophic.
“I thought my funds were safe,” LaRoque said in a video post shared days after the incident. “But one wrong move erased everything we worked for.”
Ellipal, the Hong Kong–based wallet manufacturer, confirmed that entering a hardware wallet’s seed phrase into its mobile app stores private keys directly on the device. This effectively removes cold storage protection, leaving assets exposed to malware and remote access.
In a public statement, Ellipal expressed sympathy for LaRoque’s situation:
“We were saddened to learn that our U.S. user, @Blaroque, recently lost approximately $3 million worth of XRP… Our hearts go out to him,” — Ellipal, official X (Twitter) statement, October 20, 2025.
Blockchain investigator ZachXBT traced LaRoque’s stolen XRP retirement savings through over 120 cross-chain swaps. The funds were moved from Ripple to Tron using the Bridgers protocol, then laundered through over-the-counter brokers tied to Huione, a Southeast Asian payment network sanctioned by the U.S. Treasury for facilitating global money laundering.
The complex laundering route highlights the sophistication of crypto theft operations—and the challenges of recovering stolen funds even with public blockchain visibility.
Following the theft, LaRoque filed a report with the FBI’s Internet Crime Complaint Center and contacted local cybercrime units. However, recovery prospects remain slim. According to ZachXBT, over 95% of so-called “crypto recovery” firms exploit victims of theft.
“Most recovery companies charge huge fees for minimal reports that do nothing to bring the funds back,” — ZachXBT, blockchain investigator.
These firms often target victims of XRP retirement savings losses through online ads, promising quick retrieval while offering little more than basic blockchain traces. Experts warn that genuine recoveries require coordination with regulated exchanges and law enforcement within hours of the theft—before the funds are laundered across multiple chains.
The loss of LaRoque’s XRP retirement savings underscores the need for greater user education and better self-custody safeguards. For crypto investors, the takeaway is clear: never type a hardware wallet seed phrase into a mobile or desktop application. For policy makers, the case raises questions about the regulation of self-custody tools and consumer protection in the digital asset space.
LaRoque’s experience serves as a painful reminder that security in crypto remains a shared responsibility. While blockchain transparency makes fund movement traceable, the irreversible nature of transactions means one misstep can permanently erase a lifetime’s worth of savings.
As crypto adoption grows, stories like this will continue to shape the global conversation around security, accountability, and the balance between innovation and investor protection.
