ZachXBT says $3 million worth of XRP from a crypto user in the US was laundered through Huione-linked OTC venues
Art by Crystal Le
Blockchain investigator ZachXBT said that a U.S.-based crypto user lost roughly $3.05 million (1.2 million XRP) after their Ellipal wallet was compromised, with the funds ultimately laundered through Huione-linked over-the-counter networks in Southeast Asia.
In a detailed thread on X, ZachXBT traced the movement of stolen assets through 120 Ripple-to-Tron swaps executed via Bridgers (formerly SWFT) on October 12, showing how the attacker consolidated the funds on the Tron network before dispersing them to OTC addresses adjacent to Huione by October 15.
The laundering trail led to entities linked to Huione Group, which the U.S. Financial Crimes Enforcement Network (FinCEN) formally designated a “foreign financial institution of primary money-laundering concern” earlier this month.
ZachXBT said the victim appeared inexperienced and may have misunderstood the wallet’s security configuration, believing it functioned as an offline cold wallet when in fact it operated as a hot wallet connected to the internet.
The breach led to the rapid depletion of funds, with transactions visible on block explorers as passing through Binance liquidity endpoints due to Bridgers’ infrastructure, ZachXBT noted.
ZachXBT said the recovery outlook remains low, citing limited capacity by law enforcement to pursue such cross-jurisdictional crypto crimes. He urged centralized exchanges and stablecoin issuers to implement stronger controls around OTC channels to curb illicit flows.
This is a developing story.
This article was generated with the assistance of AI and reviewed by editor Michael McSweeney before publication.
Get the news in your inbox. Explore Blockworks newsletters:
- The Breakdown: Decoding crypto and the markets. Daily.
- 0xResearch: Alpha in your inbox. Think like an analyst.
- Empire: Crypto news and analysis to start your day.
- Forward Guidance: The intersection of crypto, macro and policy.
- The Drop: Apps, games, memes and more.
- Lightspeed: All things Solana.
- Supply Shock: Bitcoin, bitcoin, bitcoin.
Decoding crypto and the markets. Daily, with Byron Gilliam.
Javits Center North | 445 11th Ave
Tues – Thurs, March 24 – 26, 2026
Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.
Research
The march toward an interoperable and onchain-by-default internet depends on reliable messaging and value transfer across heterogeneous domains. Crosschain protocols now process >$1.3T in combined annual transfer volume and secure tens of millions of user interactions, yet no single design dominates.
news
Breaking headlines across our core coverage categories.
Bitcoin miner Cleanspark launches AI infrastructure division led by veteran Jeffrey Thomas, expanding operations in Georgia
Marketplace to allocate 50% of token supply to the community and use half of the launch revenue for SEA buybacks
The proposed fund would offer institutional investors regulated exposure to Ethereum staking through Lido’s stETH token
Stripe-backed blockchain project reportedly hits $5 billion valuation as Greenoaks and Thrive lead funding round
The US government announced the largest asset forfeiture in history — all in bitcoin. Here’s why it’s not headed straight for the strategic reserve
Transparency is nice, but expensive
