The Ellipal XRP theft happened when a seed phrase was entered into the Ellipal mobile app, turning cold storage into a hot wallet and enabling roughly 1,209,990 XRP to be drained, then spread across dozens of wallets; it highlights seed-phrase exposure risks and the need to keep cold storage offline.
The incident at the center of this report involves a retiree from North Carolina who said more than $3 million worth of XRP disappeared from his Ellipal mobile app balance after a routine check on balance status. The loss, if confirmed as described by the claimant, would represent the loss of the couple’s life savings and their planned retirement home purchase in Las Vegas. The victim, Brandon Laroque, 54, described building his XRP position over several years, gradually selling portions to cover daily living costs. He said the loss felt like a sudden, indiscriminate gut punch that reshaped his family’s financial horizon.
Brandon’s account recounts a disturbing sequence: the story begins with two small 10-XRP test transactions around 11:15 a.m. Eastern time on a Sunday, followed by a sweeping transfer of approximately 1,209,990 XRP to a new address. From there, the funds split into multiple transfers across dozens of wallets over the next few hours and days, while smaller holdings such as a modest amount of XLM and FLR were untouched. The breadth and velocity of the transfers underscored the challenge of tracking stolen assets once they move off the original host and across chains or wallets.
In the immediate aftermath, Brandon filed a formal report with the FBI’s Internet Crime Complaint Center and contacted local authorities. He said the process is slow and that specialized cybercrime investigators were not always readily available, which complicated early attempts to recover the funds. “I’m speaking up because maybe someone out there can learn from what happened to us,” he told lay audiences in a YouTube discussion released after the incident. He acknowledged that he does not expect the funds to be recovered, but hopes the broader crypto community can take note of how seed management and wallet interfaces can influence security outcomes.
Ellipal blames cold-to-hot wallet confusion
Ellipal responded publicly on October 18 with a statement asserting that an internal review found Brandon had entered his hardware wallet seed phrase into the Ellipal mobile app. The company argued that seed phrase imports into a phone or tablet effectively create access to private keys and connect the wallet to the internet, compromising the very security cold wallets are designed to provide. In correspondence with Brandon, the firm explained that when a seed phrase is imported, private keys are stored on the device and the security layer that isolates cold wallets from online activity can be removed.
According to Ellipal, the device interfaces can display color indicators: a blue background on one platform suggesting a cold wallet, and an orange background on another suggesting a hot wallet. The company emphasized that its hardware wallets are air-gapped, meaning they do not connect to Wi-Fi, Bluetooth, or USB by design. Ellipal maintained that no thefts have been traced to its physical devices and asserted that the incident more likely reflects user error. Yet the company admitted it could not conclusively prove how the breach functioned on Brandon’s devices.
Brandon has questioned the color-coding distinction, noting that the user interface seemed to imply a clear boundary between cold and hot storage. He suggested that clarity in the interface could have prevented a pivotal mistake. Ellipal did not dispute the user’s core observation about the interface, but reiterated that seed phrase entry into an app immediately removes protective measures that separate cold storage from the internet.
ZachXBT traces stolen XRP across Tron and OTC brokers
On the following Sunday, on-chain investigator ZachXBT posted a detailed thread describing how the theft address was identified by aligning transaction times and values shown in Brandon’s public videos. The thread suggested the attacker used Bridgers, a swap service formerly known as SWFT, to execute more than 120 Ripple-to-Tron conversions on October 12. Some block explorers labeled certain transactions as “Binance” because Bridgers routes liquidity through exchanges.
According to the tracing, the stolen XRP was consolidated on the Tron network in a wallet labeled TGF3hP5GeUPKaRJeWKpvF2PVVCMrfe2bYw before being dispersed to multiple over-the-counter desks tied to Huione, a Southeast Asian marketplace that has drawn enforcement attention for illicit transfers. By three days later, the funds had scattered to hundreds of addresses, complicating recovery. ZachXBT cautioned followers to be wary of “crypto recovery” services, which often charge steep fees for dubious investigations, and emphasized that the most effective recourse is prompt reporting to legitimate investigators and compliant exchanges.
“Once it’s bridged across chains and hits OTC desks, there’s almost no way back,” ZachXBT remarked in the thread, underscoring the practical barriers to reversal once funds cross multiple trust boundaries. The episode has reinforced calls for improved seed-phrase handling, stronger user education around wallet interfaces, and tighter procedural checks within wallet apps to ensure a true separation between cold and hot storage states.
What is the Ellipal XRP theft incident?
The Ellipal XRP theft incident refers to a sequence in which seed-phrase entry into a mobile wallet app appears to have compromised cold storage, enabling a large-scale exfiltration of XRP. The attacker reportedly moved the funds firstly into a new address, then across numerous wallets, and finally toward on-chain pathways that included Tron-based consolidation and OTC desks. The key security takeaway is that seed-phrase handling within mobile apps can inadvertently erode air-gapped protections, turning a once-offline seed into online exposure. Public statements and on-chain analysis, including commentary from researchers and traders, align on the risk that seed-phrase exposure can pose to long-hold investors who rely on cold storage as a shield against online theft.
How does seed-phrase exposure in wallet apps affect security?
Seed phrases are the master keys to access crypto assets. When seed phrases are entered into or stored within mobile apps that connect to the internet, the private keys can become accessible to online threats. In the Ellipal case, the risk escalates when the same device is used for both reading on-chain balances and managing private keys. Air-gapped, offline operation is a core feature of true cold storage, and any step that compromises that separation increases the potential for rapid, multi-address exfiltration. Security best practices emphasize never entering seed phrases into apps that are connected to the internet, verifying that hardware wallets stay detached from online services, and maintaining separate devices strictly for cold storage operations. In addition, users should ensure that firmware and software are obtained from trusted sources, and that interfaces clearly communicate whether a wallet is truly cold or hot, to minimize the chance of misinterpretation.
Frequently Asked Questions
What steps can XRP holders take to reduce risk after incidents like this?
First, separate devices used for seed handling from everyday online devices. Use hardware wallets with verified firmware, and avoid entering seed phrases into mobile apps. Enable multi-factor access controls where possible, and maintain offline backups of seed phrases in secure locations. Regularly audit wallet configurations and be cautious with any prompts that request seed input. If a breach is suspected, immediately suspend active accounts, notify exchanges, and consult with relevant authorities and cybersecurity experts to preserve forensic integrity.
How should victims report crypto theft and pursue recovery?
Victims should file formal reports with applicable law-enforcement agencies and the FBI’s Internet Crime Complaint Center, documenting timelines, transaction hashes, and addresses. Immediate notification to exchanges and on-chain monitors can help flag stolen funds if they appear in known accounts or OTC desks. Do not rely on private “recovery” services that promise quick fixes; they often charge high fees and may be scams. Closer collaboration among victims, investigative bodies, and compliant financial institutions is essential to maximize any opportunity for reimbursement or asset tracing, though outcomes are not guaranteed.
Key Takeaways
- Seed-phrase exposure remains a critical threat: Exposing a seed phrase in a connected app can convert cold storage into a hot wallet, enabling rapid exfiltration of assets.
- Interface clarity matters: Clear, unambiguous indicators of cold versus hot states are essential to prevent user missteps when interacting with wallets and seed phrases.
- Recovery paths are limited after cross-chain moves: Once funds are bridged across chains and touched by OTC desks, recovery prospects diminish substantially; prompt reporting and compliant exchange cooperation offer the best chance of progress.
Conclusion
The Ellipal XRP episode reinforces enduring lessons for the crypto security community: guarding seed phrases, maintaining strict separation between cold storage and internet-connected platforms, and approaching wallet interfaces with a critical eye for subtle cues that might mislead users about protective states. On-chain analysts and researchers consistently emphasize that prevention—through robust device hygiene, cautious seed management, and verified, air-gapped hardware wallets—remains more effective than post-incident recovery attempts. As the ecosystem matures, the incident urges improved transparency, user education, and faster coordination among victims, investigators, and exchanges, so that assets can be safeguarded at the earliest possible stage. For now, Brandon Laroque’s experience serves as a cautionary tale about the fragile boundary between offline security and online convenience, and the need for ongoing vigilance in a dynamic and increasingly interconnected crypto landscape.
Author: COINOTAG