ZachXBT硬件钱包遭入侵，300万美元XRP被盗

Recently, there have been reports in the encryption community regarding a breach of the hardware wallet used by renowned analyst ZachXBT. Approximately $3 million in XRP was stolen. This incident serves as a reminder that even hardware wallets, which are widely regarded as the most secure method of storing assets, are not completely immune to threats. Hacking techniques continue to evolve, ranging from software vulnerabilities to social engineering attacks, leaving investors’ assets vulnerable at any time. In the world of digital currencies, security awareness must never be neglected: regardless of the amount of money involved, cold wallets, decentralized storage, and multi-factor authentication remain crucial measures to protect encrypted assets.

ZachXBT, a blockchain detective, has tracked down a theft involving $3.05 million in XRP. The thieves originated from an American retail customer. The theft occurred through Bridgers, a aggregator that was previously associated with SWFT, and then entered into an off-exchange trading platform related to Huione. Huione is a financial network located in Cambodia. Last week, the U.S. government took action to cut off its connection to the U.S. financial system.

On October 19th, ZachXBT released his findings, stating that “a victim in the United States lost $3.05 million (1.2 million XRP) from their Ellipal wallet.” He also added, “Below is a trace of the whereabouts of the stolen funds, along with lessons learned from similar thefts.”

The inside story of the $3 million XRP robbery

ZachXBT在一个帖子中通过匹配YouTube热门视频中的日期和金额，确定了被盗地址。他写道：“虽然受害者没有直接分享被盗地址……但我通过查看日期和金额找到了它。”他警告说：“受害者似乎缺乏经验，除了用户失误之外，没有提供足够的细节来确定Ellipal钱包是如何被盗的。”

根据他的重建，攻击者迅速跨链兑换瑞波币：“攻击者于2025年10月12日通过Bridgers创建了120多个瑞波币到波场币的订单。区块浏览器显示这些交易来自币安，因为Bridgers(前身为SWFT)利用这些交易进行流动性。”他写道，这些资金于10月12日在波场币TGF3hP5GeUPKaRJeWKpvF2PVVCMrfe2bYw进行整合，并于10月15日“被全部洗白到Huione(东南亚的非法在线市场)附近的场外交易平台”。Bridgers自称是一个横跨数十个网络的“跨链兑换”平台;DappRadar文档也将Bridgers与SWFT的AllChain Bridge堆栈关联起来。

提及Huione，恰好印证了快速变化的制裁环境。2025年10月14日，美国财政部将Huione集团列为“主要洗钱关注对象”，实际上将其从美国金融体系中剔除，因其为东南亚诈骗和贩运网络相关的资金流动提供便利;此次行动与英国的一揽子制裁措施以及美国针对柬埔寨企业集团太子集团(Prince Group)的平行行动相协调，后者被美国当局列为跨国犯罪组织。

ZachXBT's post focused on the confusion caused by the Ellipal wallet, rather than the zero-day vulnerabilities in the hardware itself. “One lesson that our industry needs to learn is to avoid confusing users when offering both托管和去中心化产品. Victims of XRP mistakenly believed they were using an Ellipal cold wallet, when in reality it was a hot wallet,” he wrote. He also compared this situation to cases where large-scale Coinbase accounts were used for phishing attacks, where victims transferred their assets from their exchange accounts to stolen decentralized wallets after being targeted by social engineering tactics.

Ellipal confirmed the incident of confusion between cold and hot wallets. “Our investigation revealed that the cause of the loss was users accidentally importing the seed phrase of their cold wallet into their hot wallet, allowing access to their assets online,” the company stated. They emphasized that their “isolated cold wallets remain completely offline, and have never been attacked since their launch.” Ellipal said they have contacted the users and reiterated the basic security principles: never import cold wallet seeds into app-based wallets, and keep recovery phrases and devices offline.

ZachXBT’s description of the money laundering process—rapid cross-chain transfers through aggregators, integration with Tron, and distribution to OTC endpoints he referred to as “adjacent to Huione”—reflects the type of warnings issued by U.S. authorities regarding the specialization of fraud ecosystems.

In his words, “Over the past few years, Huione has helped to launder billions of dollars in illegal funds. These funds came from various illegal activities in Southeast Asia, such as slaughtering scams, investment frauds, human trafficking, and hacking attacks/exploitation of vulnerabilities… I hope that centralized exchanges and stablecoin issuers will implement stricter controls, as they are one of the major threats to the long-term survival of this industry.”

The second topic of this post is the structural difficulties involved in recovering stolen funds. “XRP victims mentioned that they couldn’t quickly reach out to American law enforcement agencies to deal with cases involving thefts of $3 million,” he wrote. He also added that few law enforcement agencies are qualified to handle such cases, and since there are so many reports from victims, some cases simply go unnoticed. However, he pointed out that countries like the United States, Netherlands, Singapore, and France are relatively better places for recovering stolen funds—but the specifics depend on the investigators assigned to the case.

He also criticized most companies that try to “restorative” cryptocurrencies: “More than 95% of these companies are predatory. They charge high fees for basic reporting services, but they provide little useful information… Bad companies will stop tracking Bittrex’s XRP theft cases… In reality, these services are provided by Bridgers, or by addresses that have no connection to Huione at all.”

As for the possibility of compensation, the prospects are bleak. “Unfortunately, due to delays in reporting thefts to private sector officials, the chances of victims recovering their funds are quite low,” he concluded. He also urged that stolen addresses be reported promptly, in order to maximize the likelihood of freezing financial flows at critical points. He also criticized the support provided at the ecosystem level: “The Ripple community’s support system for victims is not as good as that of Bitcoin, Ethereum, Solana, and other major EVM-based blockchains.” As of press time, the price of XRP is $2.44.