Skip to main content
AVOID.NET

Summary

Chris Larsen is the co-founder and Executive Chairman of Ripple, one of the most prominent figures in the XRP ecosystem. On January 30, 2024, attackers drained an estimated 213–283 million XRP (valued at $112.5–$150 million) from his personal cryptocurrency accounts — not Ripple corporate wallets — in what became the largest individual crypto theft of 2024. A U.S. government forfeiture complaint filed in March 2025 linked the breach to the 2022 LastPass password manager hack, alleging that private keys had been stored in an online vault subsequently compromised by attackers.

Connected Entities

8 entities · 60 linked investigations
Organizations
Protocols
Wallets
rJNLz3…Qojm
Relationships
  • rJNLz3…Qojmmentioned withChris Larsen(50%)
  • ZachXBTmentioned withKraken(60%)
  • ZachXBTmentioned withBinance(60%)
  • LastPassmentioned withFixedFloat(65%)
  • LastPassmentioned withKraken(65%)
  • LastPassmentioned withZachXBT(70%)
  • Chris Larsenmentioned withRipple Labs(90%)
  • Chris Larsenmentioned withZachXBT(70%)
  • Chris Larsenmentioned withFixedFloat(70%)
  • Chris Larsenmentioned withBinance(70%)
  • + 5 more
Have evidence about Chris Larsen?

Timeline(26 events)

September 2012

Chris Larsen co-founds Ripple Labs, Inc. alongside Jed McCaleb; becomes CEO.

Wikipedia

September 2012

Chris Larsen co-founds OpenCoin (later renamed Ripple Labs), beginning development of the Ripple payment protocol and XRP ledger.

Wikipedia / CoinPaper

January 2013

Ripple begins selling XRP to institutional investors; the SEC would later allege this constituted an unregistered securities offering.

SEC Press Release 2020-338

January 2016

Larsen steps down as CEO of Ripple; becomes Executive Chairman.

Wikipedia

December 2020

SEC files complaint against Ripple Labs, Brad Garlinghouse, and Christian A. Larsen, alleging $1.3 billion in unregistered XRP securities offerings. Larsen personally alleged to have sold approximately $600 million in unregistered XRP.

SEC.gov

22 December 2020

SEC files enforcement action against Ripple Labs, CEO Brad Garlinghouse, and co-founder Chris Larsen, alleging unregistered securities sales of XRP totaling approximately $1.3 billion.

SEC.gov

August 2022

LastPass suffers first major security breach; source code and technical information exfiltrated.

Krebs on Security

August 2022

LastPass suffers its first major security breach. A second breach follows in November 2022. Attackers steal encrypted customer password vaults from the platform.

Krebs on Security

November 2022

LastPass suffers second breach; encrypted customer password vaults stolen. Larsen's vault — allegedly containing XRP private keys in Secure Notes — is among those compromised.

Krebs on Security

November 2022

Second LastPass breach: attackers access cloud storage containing encrypted user vault backups using credentials stolen in the August 2022 incident.

BleepingComputer

July 2023

U.S. District Judge Analisa Torres issues summary judgment in SEC v. Ripple: institutional XRP sales violated securities law; programmatic secondary-market sales did not.

CNBC

13 July 2023

Judge Analisa Torres issues partial summary judgment in SEC v. Ripple, finding that programmatic XRP sales on exchanges were not securities transactions; certain institutional sales were. SEC drops individual charges against Larsen and Garlinghouse in October 2023.

Decrypt

October 2023

SEC drops all personal charges against Larsen and Garlinghouse; case against Ripple Labs continues.

BusinessWire / Paul Weiss

30 January 2024

Larsen's personal XRP wallets hacked; approximately 213 million XRP ($112.5M) drained. ZachXBT detects and reports the unauthorized outflows in real time. Stolen funds routed through MEXC, Gate.io, Binance, Kraken, OKX, HTX, and HitBTC.

CoinDesk / TechCrunch

30 January 2024

Approximately 213–237 million XRP is drained from Chris Larsen's personal wallets across 8 transactions spanning 11 hours. WhiteBIT is the first exchange to detect suspicious inflows and alert Larsen's team. The primary compromised address is rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm.

TheCryptoBasic / TechCrunch / ZachXBT

31 January 2024

Larsen publicly confirms hack via X, states breach was limited to personal accounts, law enforcement notified, exchanges alerted to freeze affected addresses.

X (@chrislarsensf)

31 January 2024

ZachXBT publicly identifies the breach in a Telegram post, flagging on-chain evidence of 213 million XRP ($112.5M) stolen from an address linked to Larsen. XRP price falls approximately 5% amid rumors of a Ripple network breach.

CoinDesk / The Block

February 2024

Binance CEO Richard Teng announces Binance has frozen $4.2 million worth of stolen XRP deposits made by the attacker.

CoinDesk

February 2024

Hacken publishes on-chain forensic analysis identifying eight intermediate wallets used by the attacker, including addresses rGhR13XyM43WdDaSMznHd5rZ4cJatybvEg, rHQVKntyfkDCPhEBL2ctryuEAkDZgckmmV, rLsUemhuBZtF44rqqzneb2F9JgyrRYYd4t, rKPERax7t9iFvT3RHXn5nifyNpzp9a4hBa, and rpjs4HLX1gJoEenH69PsQmXaXY22QhCYAT. Hacken flags a possible link to an XRP-authorized wallet (rU1bPM4) and raises the possibility of insider involvement.

Hacken / CoinTelegraph

2 February 2024

Binance announces it has frozen $4.2 million in XRP tokens linked to the theft. Binance CEO Richard Teng states the exchange will continue to monitor the exploiter's remaining external wallet holdings.

CoinDesk

June 2024

U.S. law enforcement begins tracing and seizing stolen cryptocurrency from exchanges. Between June 2024 and February 2025, approximately $23.6 million is recovered from OKX, Kraken, WhiteBIT, AscendEX, FixedFloat, SwapSpace, and CoinRabbit.

BleepingComputer

March 2025

ZachXBT and Krebs on Security report the forfeiture complaint's findings; forfeiture document identifies Larsen as Victim-1 and confirms the LastPass breach as the attack vector. Total stolen revised upward to $150M (283M XRP at updated valuations).

Krebs on Security

March 2025

SEC and Ripple reach final settlement. Ripple pays $125 million civil penalty. All appeals dropped. All charges against Larsen personally are fully resolved with no admission of wrongdoing.

CNBC / CoinDesk

6 March 2025

Federal prosecutors in Northern District of California announce seizure of $23,604,815 in cryptocurrency traced to the January 2024 theft, from exchanges OKX, Kraken, WhiteBIT, AscendEX, FixedFloat, SwapSpace, and CoinRabbit. Forfeiture complaint formally links the theft to the 2022 LastPass breaches.

BleepingComputer

7 March 2025

ZachXBT publicly discloses the contents of a U.S. civil forfeiture complaint (Northern District of California) formally linking Larsen's January 2024 theft to the 2022 LastPass password manager breaches. The complaint identifies Larsen as 'Victim-1' and notes private keys were stored in a compromised online password manager vault. The complaint also confirms $23,604,815.09 in seized assets.

Krebs on Security / CoinDesk

7 August 2025

Ripple Labs and SEC file joint stipulation of dismissal, formally ending SEC v. Ripple after more than four and a half years. Ripple pays $50 million; $75 million in escrowed funds is returned.

Decrypt / SEC.gov

Research Gaps

1 open · agent-resolvable

Heuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.

  • [med]
    unarchived sources

    Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.

Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 21 of 22 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 5/4/2026, 4:05:05 PM

last updated: 8/29/2026, 1:35:51 AM

5 views

avoid.net — verified advice for a post-truth world