A North Carolina retiree watched helplessly as his entire life savings vanished into crypto oblivion. Brandon LaRoque lost 1.2 million XRP tokens—worth about $3 million—in what experts are calling a classic case of user error with catastrophic consequences. Eight years of careful investing, gone. Just like that.
The theft happened around October 12, 2025. LaRoque didn’t notice until October 16. By then, his wallet was bone dry. Empty. The attackers had moved quickly, executing a massive transfer of 1.29 million XRP to a fresh wallet after some smaller test transactions.
Here’s where things went south: LaRoque imported his cold wallet‘s seed phrase into the Ellipal mobile app. Rookie mistake. This transformed his supposedly secure “cold” storage into a vulnerable “hot” wallet connected to the internet. Ellipal confirmed this critical error was the source of the breach. Their hardware wallets remain secure—if you actually use them correctly.
One crypto mistake can nuke your life savings. Cold storage isn’t cold if you expose your seed phrase online.
The thieves knew exactly what they were doing. They scattered the stolen funds across hundreds of wallets and executed over 120 cross-chain swaps. From Ripple to Tron, then through various OTC desks linked to Huione, a sanctioned Southeast Asian money laundering network. Good luck tracking that mess. The sophisticated mixing technique employed made it virtually impossible for investigators to trace the origin of the stolen cryptocurrency.
LaRoque filed reports with IC3 and local police, but recovery chances? Slim to none. Law enforcement lacks the specialized expertise to handle sophisticated crypto crime. Meanwhile, his retirement plans are in shambles.
This isn’t just a sad story about one retiree. It’s a stark warning about the brutal reality of crypto security. The difference between proper and improper handling of a seed phrase was $3 million. Regular activity monitoring could have alerted LaRoque to the suspicious transactions before his entire holdings were depleted. The crypto world doesn’t offer second chances or password resets. LaRoque’s case underscores the importance of securing cold wallets properly, a point he now hopes to raise awareness about among other cryptocurrency investors.
The case has exploded across social media, with many calling for better in-app warnings or removing seed-import features altogether. Too little, too late for LaRoque. His golden years just got considerably less golden.
