A U.S. crypto holder has lost more than $3 million after his Ellipal hardware wallet was compromised, according to findings shared by blockchain investigator ZachXBT.
The stolen assets, equivalent to roughly 1.2 million XRP, were reportedly funneled through the Tron blockchain using a cross-chain bridge service called Bridgers. From there, the funds were laundered through Huione, an over-the-counter network based in Southeast Asia that was recently sanctioned by the U.S. government for its role in large-scale fraud and money laundering operations.
A Sophisticated Laundering Trail
ZachXBT traced the transactions after identifying the victim’s wallet from a YouTube video that had gone viral. The attacker allegedly executed over 120 transfers between Ripple and Tron on October 12, 2025, using Binance liquidity routed through Bridgers. By October 15, the stolen XRP had been fully moved into wallets tied to Huione-linked OTC brokers.
Huione has been accused of facilitating the movement of billions in illicit funds across Asia, including proceeds from cybercrime, human trafficking, and online investment scams. The U.S. Treasury expanded its sanctions on the company last week as part of a broader $15 billion investigation involving the Cambodia-based Prince Group.
Mistaken Identity: Cold Wallet or Hot Wallet?
In his analysis, ZachXBT emphasized that confusion over wallet security was a major factor in the breach. The victim believed he was using Ellipal’s cold storage device – considered one of the safest options for holding crypto – but it turned out to be a connected hot wallet vulnerable to remote attacks.
He added that similar misunderstandings occur frequently on centralized platforms like Coinbase, where users assume assets are stored offline. The researcher also noted that the victim struggled to find U.S. law enforcement agencies equipped to investigate crypto thefts of this complexity, highlighting a growing gap between cybercriminal activity and enforcement capacity.
The incident underscores how hardware wallet misuse and cross-chain laundering continue to challenge the industry’s efforts to improve investor protection and traceability.
