2/ Although the victim did not directly share the theft address after watching the video I found it by reviewing the date and amount. r3cf5mgj5qEcj9n4Th28Es7NVRnXGJjkzc The victim seems inexperienced and does not provide enough details to determine how the Ellipal wallet

3/ The attacker created 120+ Ripple -> Tron orders via Bridgers on Oct 12, 2025. On block explorers the transactions show as Binance since Bridgers (formerly SWFT) uses them for liquidity.

4/ The funds consolidated on Tron at the following address on Oct 12. TGF3hP5GeUPKaRJeWKpvF2PVVCMrfe2bYw By Oct 15 the funds were completely laundered away to OTCs adjacent to Huione (illicit online marketplace in SEA).

5/ Huione has directly facilitated laundering billions in illicit funds over the past couple years from pig butchering scams, investment scams, human trafficking and hacks/exploits in Southeast Asia. Last week the US applied additional restrictions against Huione in relation to

6/ One lesson our industry needs to do better with is not causing confusion with products when you offer both custodial and non-custodial products. The XRP victim thought they were using the Ellipal cold wallet product when it was a hot wallet. Frequently I see large Coinbase

7/ The XRP victim mentioned in a later video how they could not quickly get in touch with US law enforcement for a $3M theft. There’s few LE qualified to handle such cases and endless victim reports so naturally incidents are overlooked. In general US, Netherlands,

8/ Another lesson is >95% of recovery companies are predatory and charge large amounts for basic reports with few actionable insights. I have found the firms who optimize SEO tend to be more predatory. Predatory firms will pursue cases when recovery does seem not viable just

9/ Unfortunately the likelihood of this victim seeing any funds recovered is rather low due to a delay in reporting the theft to competent people within the private sector. I recommend victims try to report theft addresses to people as soon as possible as otherwise it can be

@zachxbt decent research but can you trace my 0.001 SOL that I got scammed for 2 years ago?

@VoidOnChain lol

@zachxbt Honestly now centralized exchange with multiple 2fa is safer for most users, compared to non custodial wallet

@lalasonghs Yes I think self custody is not the right answer for vast majority of people

@zachxbt "Ripple does not have as good of a support system for victims within their community as there is in Bitcoin, Ethereum, Solana, and major EVM chains" Ripple yikes

@FabianoSolana Lack of retail analytics tools & victim orgs that receive grants to provide support

@zachxbt Actually, thanks for doing the analysis on the stolen XRP. Should be seen as education, specifically that self custody is not for everyone best suited tbh.

@Vet_X0 No problem

@zachxbt Someone make this thread a tiktok

@waleswoosh True

@zachxbt Can you tell us how laundering through huione works

@Pnlpal Read more about it here in this piece by @elliptic https://www.elliptic.co/blog/c...

@zachxbt Average xrp user

@0xCre No comment

@zachxbt Wait under what jurisdiction does Huione reside?

@OG_driann Cambodia

@zachxbt Bro you finally helped this guy appreciate you

@7x_Dozi I was tagged / messaged too many times

@zachxbt thx for the thread. do you mind sharing how much effort an investigation/analysis like this is for you? just curious as a guy interested in this space but inexperienced.

@HimugLamuh spent ~4 hrs total (tracing/writing)

@zachxbt Well done, legend Your performance is truly admirable My wish is to become someone like you one day, Sir

@0xCharsi Ty

@zachxbt amazing write up once again, ty!

@bellx_crypto 🤝

@zachxbt Good thread

@SarthiB7 ty