Ellipal Wallet Case How a $3 Million XRP Loss Shows the Danger of Mixing Cold and Hot Storage

Ellipal Wallet Case How a $3 Million XRP Loss Shows the Danger of Mixing Cold and Hot Storage

In October 2025, a North Carolina retiree lost about 1.2 million XRP, worth roughly $3.05 million. The funds left his Ellipal wallet on the 12th and he only noticed three days later.

Blockchain investigator ZachXBT later followed the trail through cross-chain swaps and into over-the-counter networks linked to Huione, a Southeast Asian platform that U.S. authorities have flagged for large-scale money laundering.

What Actually Happened

The victim, Brandon LaRoque, had been stacking XRP for years and thought his coins were safe in cold storage. He owned an Ellipal hardware wallet, a physical device built to keep private keys offline. The problem started when he imported the wallet’s recovery seed phrase into Ellipal’s mobile app.

Once that seed sits on a phone or tablet connected to the internet, the private keys are no longer offline. At that point the setup turns into a hot wallet and becomes open to remote attacks.

Ellipal later confirmed this. The company said its air-gapped hardware devices were never breached. The loss happened because the seed phrase was entered into an online app, which exposed the keys.

How the Funds Moved

On October 12, the attacker first sent two small test transactions of 10 XRP each. Then the rest of the balance, around 1.21 million XRP, was swept to a new address. From there, the coins were quickly split across dozens of wallets and later hundreds. ZachXBT’s tracing showed more than 120 XRP-to-Tron swaps through a service called Bridgers.

The funds were gathered on the Tron network and then moved through over-the-counter desks connected to the Huione network.

By the time the victim checked his balance, the trail was already complicated.

The Core Lesson

Hardware wallets only protect your funds when the recovery seed stays completely offline. The moment you type that seed into any mobile app, desktop software, or website, the private keys are recreated on an internet-connected device. The main security advantage of the hardware disappears.

A lot of people assume that simply owning a hardware wallet means their coins are in cold storage. In reality, the security depends entirely on what happens to the seed phrase after the device is set up.

What Holders Should Do Differently

Never type a hardware wallet seed phrase into any phone app, computer program, or website. Keep the written seed offline and away from anything connected to the internet. If you just need to check balances, use a watch-only setup that does not require the private keys.

For larger amounts, look at multisignature arrangements or extra layers that reduce single points of failure. And always double-check the exact mode your wallet software is running in. Color cues and labels can be easy to misread.

If You Have Lost Crypto or Suspect Your Wallet Was Compromised

Contact BitcoinRecovery.io today. Tell us what happened, which wallet you used, and when the funds moved. We will review the details, explain realistic tracing or recovery options where possible, and outline clear next steps. The conversation stays private. We don’t charge any upfront fee.

Reach out now. The sooner the situation is examined, the clearer the available paths usually become.