Imagine saving for eight years, watching your retirement nest egg grow, and then opening an app to find every coin gone. This is what happened to 54-year-old Brandon LaRoque, a long-time XRP (XRP-USD) investor who says he lost $3 million in crypto in a matter of minutes.
Elevate Your Investing Strategy:
- Take advantage of TipRanks Premium at 50% off! Unlock powerful investing tools, advanced data, and expert analyst insights to help you invest with confidence.
He discovered the loss on October 15 after logging into Ellipal’s mobile app. The theft had occurred three days earlier. “It was everything,” he said in a video posted online. “That was our house money, our retirement.” The shock was immediate and devastating. Moreover, what followed revealed a trap many crypto users still fall into, misunderstanding how “cold” wallets can suddenly turn hot.
A Seed Import That Melted the Cold
Ellipal, the Hong Kong-based wallet maker, said its review showed the investor had entered his hardware wallet’s recovery seed into its mobile app. This action, according to the company, recreated the private keys on an internet-connected device. In other words, the wallet was no longer offline.
Brandon had been using the Ellipal app on both an iPhone and an iPad. He said one showed a blue background, meaning cold, while the other displayed orange, meaning hot. Moreover, the color-coding difference confused him. The device that stored his seed was connected to the internet. Within hours, an attacker drained more than 1.2 million XRP. Smaller amounts of other tokens like XLM and FLR remained untouched, a surgical strike that suggested experience, not luck.
The Blockchain Tells a Trail of Loss
On-chain investigator ZackXBT quickly traced the theft. He said the attacker used more than 120 Ripple-to-Tron swaps via a bridge service called Bridgers, formerly known as SWFT. From there, the funds moved across wallets and ended up at over-the-counter brokers in Southeast Asia.
Moreover, some of those venues have been linked to gray-market trading networks tied to Huione, a marketplace flagged by U.S. authorities earlier this year. The precision of the transfers made recovery nearly impossible. Each hop moved the XRP farther away from traceable exchanges and into private settlements.
It Was a Costly Lesson in Crypto Security
Ellipal has insisted its hardware remains secure and air-gapped, emphasizing that the breach came from the mobile environment. The company expressed sympathy but said it could not be responsible for user behavior outside its device. Brandon, meanwhile, filed reports with the FBI’s cyber unit and local police, though he admits the odds of recovering funds are slim.
Moreover, experts say his experience exposes a common misconception. A cold wallet only stays cold if its seed never touches a connected device. Once that happens, even briefly, it becomes a hot wallet and is vulnerable to remote theft. In crypto, one misplaced tap can turn an impregnable vault into an open door.
This Case Is a Warning to Crypto Investors
The story spread fast across social media and crypto forums. Some called for Ellipal to add stronger in-app warnings or remove the seed-import feature altogether. Others blamed user error and urged investors to double-check every security step before moving life savings into digital form.
Moreover, analysts like ZackXBT used the case to highlight a darker pattern. He warned that recovery services promising to trace stolen coins often prey on victims, charging high fees while producing little more than screenshots. Once funds cross multiple chains and hit OTC desks, even law enforcement faces a dead end.
Key Takeaway
One retiree’s loss has become a cautionary tale for everyone holding crypto. The technology is powerful, but it is also unforgiving. Brandon LaRoque’s mistake was simple, a seed in the wrong place at the wrong time, yet it erased an entire future.
The episode reminds investors that in digital finance, safety is attributed to discipline. Cold wallets protect assets only as long as humans resist shortcuts. In this case, a few taps on a touchscreen cost $3 million and a lifetime of security shattered in seconds.
At the time of writing, XRP is sitting at $2.4725.
