ZachXBT links $3M XRP theft to wallet-draining phishing ring
ZachXBT says $3 million worth of XRP from a crypto user in the US was laundered through Huione-linked OTC venues
Art by Crystal Le
Blockchain investigator ZachXBT said that a U.S.-based crypto user lost roughly $3.05 million (1.2 million XRP) after their Ellipal wallet was compromised, with the funds ultimately laundered through Huione-linked over-the-counter networks in Southeast Asia.
In a detailed thread on X, ZachXBT traced the movement of stolen assets through 120 Ripple-to-Tron swaps executed via Bridgers (formerly SWFT) on October 12, showing how the attacker consolidated the funds on the Tron network before dispersing them to OTC addresses adjacent to Huione by October 15.
The laundering trail led to entities linked to Huione Group, which the U.S. Financial Crimes Enforcement Network (FinCEN) formally designated a “foreign financial institution of primary money-laundering concern” earlier this month.
ZachXBT said the victim appeared inexperienced and may have misunderstood the wallet’s security configuration, believing it functioned as an offline cold wallet when in fact it operated as a hot wallet connected to the internet.
The breach led to the rapid depletion of funds, with transactions visible on block explorers as passing through Binance liquidity endpoints due to Bridgers’ infrastructure, ZachXBT noted.
ZachXBT said the recovery outlook remains low, citing limited capacity by law enforcement to pursue such cross-jurisdictional crypto crimes. He urged centralized exchanges and stablecoin issuers to implement stronger controls around OTC channels to curb illicit flows.
This is a developing story.
This article was generated with the assistance of AI and reviewed by editor Michael McSweeney before publication.
Get the news in your inbox. Explore Blockworks newsletters:
- The Breakdown: Decoding crypto and the markets. Daily.
- 0xResearch: Alpha in your inbox. Think like an analyst.
- Empire: Crypto news and analysis to start your day.
- Forward Guidance: The intersection of crypto, macro and policy.
- The Drop: Apps, games, memes and more.
- Lightspeed: All things Solana.
- Supply Shock: Bitcoin, bitcoin, bitcoin.
