A North Carolina retiree’s life savings vanished in a devastating $3.05 million XRP theft after his Ellipal hardware wallet was compromised, with funds traced to a sanctioned Southeast Asian money laundering network. The incident, analyzed by blockchain sleuth ZachXBT, underscores the dangers of self-custody and the crypto industry’s gaps in user education and recovery support.
A Retiree’s Life Savings Wiped Out
On October 12, 2025, Brandon LaRoque, a 54-year-old retiree, lost over 1.2 million XRP—valued at $3.05 million—after his Ellipal wallet was hacked. LaRoque, who had been accumulating XRP since 2017, shared his heartbreak in a viral YouTube video, explaining how the theft derailed his and his wife’s retirement plans, including a move to Las Vegas. The breach began with small test transfers of 10 XRP, followed by a massive transfer to a newly created wallet, which then dispersed the funds across hundreds of addresses to obscure the trail.
Laundering Through a Sanctioned Network
Blockchain investigator ZachXBT traced the stolen XRP, revealing the attacker executed over 120 Ripple-to-Tron conversion orders via Bridgers exchange before consolidating funds on the Tron blockchain. By October 15, the entire sum was laundered through over-the-counter (OTC) desks linked to Huione, a Southeast Asian marketplace recently sanctioned by the US Treasury for facilitating billions in illicit transactions, including pig butchering scams and crypto hacks. This sophisticated laundering operation highlights the challenges of tracking stolen crypto across blockchains.
Hot Wallet Confusion Fuels Vulnerability
The theft exposed a critical misunderstanding: LaRoque believed he was using Ellipal’s cold wallet, a secure offline storage device, but had imported his seed phrase into the Ellipal app, turning it into a vulnerable hot wallet. ZachXBT noted that such confusion between custodial and non-custodial products is rampant in the crypto industry, often exploited through social engineering scams like Coinbase support impersonation. Ellipal confirmed the error in a statement, emphasizing their ongoing support for the victim but underscoring the risks of improper wallet use.
Recovery Challenges and Industry Gaps
LaRoque’s attempts to seek recourse through the Internet Crime Complaint Center (IC3) and local law enforcement were met with limited expertise, a common issue in crypto-related crimes. ZachXBT warned that recovery prospects are “extremely low” due to delayed reporting and the predatory nature of over 95% of recovery companies. Unlike Bitcoin or Ethereum communities, Ripple lacks robust victim support systems, leaving users like LaRoque with few options. The investigator stressed that self-custody remains unsuitable for most users due to its complexity and risks.
A Call for Better Education and Support
This incident serves as a stark reminder of the vulnerabilities in crypto self-custody and the urgent need for better user education. ZachXBT advocates for immediate reporting of theft addresses to knowledgeable parties to improve detection chances, though he struggles to handle the volume of daily requests. As crypto adoption grows, the industry must address these gaps in user understanding and law enforcement capabilities to prevent more retirees like LaRoque from losing their financial security to preventable hacks.