A $3 million XRP theft incident drained a US retiree’s Ellipal wallet, revealing the predatory industry that preys on victims after a hack.Blockchain investigator ZachXBT, who traced the $3.05 million loss through over 120 cross-chain swaps, warned that most firms charge desperate users exorbitant fees for hollow promises of restitution.Sponsored
Sponsored$3 Million XRP Hack Unmasks Crypto’s Predatory Recovery FirmsThe incident began when Brandon LaRoque discovered that his 1.2 million XRP had been drained from his Ellipal wallet earlier this month. Notably, the loot, worth $2.88 million at current rates, comprised the 54-year-old retiree’s life savings, accumulated since 2017. He had believed his funds were secured in cold storage. Later, however, LaRoque learned that importing his seed phrase into the Ellipal mobile app had effectively converted the setup into a hot wallet.
“I’ve been accumulating XRP for the past eight years,” LaRoque said in a YouTube video recounting the theft. “It was our whole retirement, and I don’t know what we’re going to do.”
ZachXBT’s on-chain investigation found that the attacker converted the stolen XRP through 120 Ripple-to-Tron bridge transactions. They leveraged Bridgers (formerly SWFT), before consolidating the funds on Tron.Within three days, the assets had vanished into OTC desks tied to Huione. The US Treasury recently sanctioned the Southeast Asian payments network for laundering billions from scams, human trafficking, and cybercrime.The case exposes a key weakness in global enforcement by linking the XRP theft to Huione’s network. US authorities say Huione has facilitated more than $15 billion in illicit transfers. The weakness is that even when blockchain trails are public, cross-jurisdictional laundering pipelines remain difficult to disrupt.Sponsored
SponsoredPredatory Recovery IndustryWhile law enforcement often struggles to respond swiftly, ZachXBT says a recovery economy has emerged to exploit victims’ desperation.
“Another lesson is >95% of recovery companies are predatory and charge large amounts for basic reports with few actionable insights,” he wrote.
Many such firms, he added, rely on SEO and social-media targeting to lure victims. They often provide only superficial blockchain reports or telling clients to “contact the exchange.”This secondary layer of exploitation has turned many high-value hacks into multi-stage crimes. First, by the hacker, and then by fake recovery operators who promise to reclaim funds that are, in reality, long gone.Self-Custody Confusion and the Broader RiskBeyond the laundering trail, the Ellipal case reignited debate around the safety of self-custody. The victim’s confusion between Ellipal’s cold wallet and its app-based hot wallet mirrors the issue of unclear wallet design and user education gaps.
Yes I think self custody is not the right answer for vast majority of people— ZachXBT (@zachxbt) October 19, 2025
The odds of recovering LaRoque’s $3 million are slim, amid few law-enforcement units equipped to handle crypto-related crimes. The challenge increases with cross-border laundering networks like Huione thriving.However, the real tragedy, ZachXBT implies, is that the next wave of losses may not come from hackers, but from those claiming to help get the money back.
