Ripple Co-Founder Chris Larsen’s Personal Accounts Compromised: $100m in XRP Sent to Exchanges

On January 30, 2025, on-chain investigator ZachXBT made a shocking revelation that Ripple, a popular cryptocurrency, had been compromised for approximately 213 million XRP, valued at around $112.5 million. The compromised funds were reportedly sent to various exchanges from a wallet that was allegedly activated by Chris Larsen, the Co-Founder and Executive Chair of Ripple.

ZachXBT identified that the stolen funds were funneled through several exchanges, including Gate, Binance, Kraken, OKX, HTX, HitBTC, and MEXC. A total of 8 addresses were linked to the alleged theft. Prior to ZachXBT’s findings, neither Ripple Labs nor Larsen had made any public statements regarding the attack.

In response to the allegations, Chris Larsen clarified that it was his personal Ripple accounts that had been compromised, not Ripple’s corporate assets. He reassured his followers that the breach had been quickly identified, and exchanges were contacted to freeze the affected addresses. Larsen emphasized that the breach was an “isolated incident” and confirmed that Ripple’s wallets were secure and had not been compromised.

Efforts to recover the stolen funds were underway, with law enforcement actively involved in the process. Larsen mentioned that a significant portion of the stolen funds had already been frozen, and steps were being taken to recover the remaining amount.

The incident occurred amidst a strong performance by XRP, with the cryptocurrency closing above $3 for 15 consecutive days. At the time of writing, XRP was trading at $3.09, just 9% below its all-time high of $3.40 set on January 7, 2018.

This incident serves as a reminder of the risks associated with cryptocurrency investments and the importance of securing personal accounts. The cryptocurrency community will be closely monitoring the developments surrounding the recovery of the stolen funds and any potential security measures implemented by Ripple in the aftermath of this breach.