Ripple co-founder Chris Larsen confirms “unauthorized access” to “a few of my personal XRP accounts”, after ZachXBT noted outflows of 213M XRP, worth $112.5M
but its co-founder was Pierluigi Paganini / Security Affairs : Crooks stole around $112 million worth of XRP from Ripple's co-founder Finextra : Ripple co-founder's personal XRP accounts hacked Tristan Greene / Cointelegraph : Ripple chairman Chris Larsen hacked for reported 213M XRP worth approximately $112.5M CoinGape : Ripple XRP Update : Was Ripple Really Hacked ? Sam Wisdom Raphael / The Crypto Basic : Ripple Chairman Confirms Hack to His Personal XRP Account, Not Ripple Bhushan Akolkar / Coinspeaker : Ripple Co-founder Chris Larsen Allegedly Lost $112M in XRP Wallet Theft Amara Khatri / Crypto Daily : Ripple Co-Founder Falls Victim To Hack, Loses $112 Million Qadir AK / Coinpedia Fintech News : Ripple News: $112 Million XRP Hack Targets Chairman's Account Deeba Ahmed / Hackread : Ripple Co-Founder's Personal XRP Wallet Breached in $112 Million Hack Oliver Dale / Blockonomi : Ripple Founder Larsen Loses $112M in XRP to Hackers Teuta Franjkovic / CCN.com : XRP Falls by More Than 5% After Ripple Exec Accounts Drained in $112 Million Hack Brandy Betz / Unchained : Ripple Co-Founder Confirms $112.5 Million XRP Hack X: Chris Larsen / @chrislarsensf : Yesterday, there was unauthorized access to a few of my personal XRP accounts (not @Ripple) - we were quickly able to catch the problem and notify exchanges to freeze the affected addresses. Law enforcement is already involved. @zachxbt : It appears @Ripple was hacked for ~213M XRP ($112.5M) Source address rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm So far the stolen funds have been laundered through MEXC, Gate, Binance, Kraken, OKX, HTX, HitBTC, etc [image] Brad Garlinghouse / @bgarlinghouse : Given some irresponsible speculation and reporting, I want to reiterate that NO Ripple-managed wallets were compromised. Full stop. @zachxbt : @chrislarsensf @Ripple Totally completely separate entities *wink* *wink* Chris Larsen / @chrislarsensf : @Ripple This is an isolated incident, and Ripple wallets are secure / were never compromised. We've confirmed nearly all the affected funds were converted out of XRP. We're working with law enforcement and have been advised that a significant portion of funds have been frozen, and are... Conor / @jconorgrogan : @zachxbt @Ripple Wild that you are the first person to comment on this, looks like these transactions are 10+ hours old Adam Cochran / @adamscochran : A *few* of your accounts? Why the hell were you keeping 5 accounts with tens of millions in assets on a single device/system? jfc. Steven / @dogetoshi : That's multiples less than what Ripple dumps every month so who's the real hacker? @lsdinmycoffee : @zachxbt @Ripple lmao, Garlicmouth finding other ways to dump on The Army while SEC is watching him? i'm crying out loud, they want people to believe banks are going to trust this joke of a company? @wazzcrypto : @zachxbt @Ripple The fact you figured this out is genuinely impressive lmao, because who the hell is tracking XRP addresses these days 😂 Are there even tagged wallets? I dont think I've ever used a xrp explorer @defiyst : @jconorgrogan ... Everyone so used to seeing Ripple Co-Founders dumping 9 figs of XRP, no one even took notice overnight lmao Laurence / @functi0nzer0 : There was a hundred million on Ripple? Lefteris Karapetsas / @lefterisjp : “a few of my personal accounts” -> $113m What a flex 😁 Wizz / @cryptowizardd : Time to retire sir. Eleanor Terrett / @eleanorterrett : 🚨NEW: @Ripple founder @chrislarsensf confirms unauthorized access of his personal $XRP accounts, not @Ripple's. The affected addresses have been frozen and law enforcement is involved. 👇🏼
Context & Ripple Effects
The incident is explicitly confined to Chris Larsen’s personal accounts rather than Ripple-managed wallets, separating executive key custody from the company’s operating infrastructure. Its scale also matters because earlier coverage identified Larsen as a major XRP holder through his multibillion-XRP holdings.
The response follows a familiar crypto-incident pattern: investigators trace on-chain flows while exchanges are asked to stop funds at identifiable addresses. The earlier tracing of Ronin theft proceeds illustrated both the visibility of blockchain transfers and the difficulty of preventing assets from moving across venues.
First-order effects
- Larsen’s affected personal accounts lost roughly 213 million XRP; most of the assets were converted out of XRP, while notified exchanges froze a significant portion of the identified funds.
- Ripple can limit immediate corporate-contagion risk by stating that its managed wallets were unaffected, but Larsen and law enforcement must pursue recovery across the exchanges used in the laundering route.
Second-order effects
- Exchanges named in the reported flow path face immediate pressure to coordinate freezes, preserve transaction records, and distinguish recoverable balances from funds already moved or converted.
- The breach puts greater scrutiny on the security practices surrounding large personal crypto holdings, even where the associated company’s own wallets were not compromised.
Third-order effects
- If cross-exchange freezing and tracing become routine, incident response in crypto will increasingly depend on cooperation between nominally independent trading venues rather than on the underlying ledger alone.
- The event reinforces the crypto legitimacy gap: transparent transaction trails can aid investigation, but personal-wallet security and fragmented venue controls remain material weaknesses.
The trend: Large crypto thefts are making cross-venue tracing, rapid freezes, and clearer separation of personal and corporate custody central to trust in the sector.