v1 → v2

Background and Role

January 2024 Personal Wallet Hack ($112–150M XRP Stolen)

Binance Freeze of Stolen Funds

LastPass Breach as Attack Vector

DOJ Forfeiture and Asset Recovery

SEC Enforcement: Unregistered Securities Offering

On-Chain Profile and Exchange Activity

(section 8)

- Christian A. Larsen (born 1960, San Francisco) is a serial Silicon Valley entrepreneur and one of the most influential figures in the cryptocurrency industry. He earned a BS in international business and accounting from San Francisco State University in 1984. He co-founded E-Loan in 1996, the first U.S. company to freely provide consumers' FICO credit scores, which reached a market capitalization of approximately $1 billion before being sold to Banco Popular in 2005. In 2006, he co-founded Prosper Marketplace, a peer-to-peer lending platform, and served as CEO until 2012. In September 2012, Larsen co-founded OpenCoin, which began developing the Ripple payment protocol. The company was later rebranded as Ripple Labs and then Ripple. Larsen served as Ripple's CEO until 2016 and subsequently as Executive Chairman. His personal XRP holdings are estimated at 2.5–2.7 billion tokens, making him one of the largest individual XRP holders in the world. At the peak of XRP's price in January 2025 ($3.84), his paper net worth briefly exceeded $60 billion, ranking him among the ten wealthiest people globally according to contemporaneous reporting.+ 

(section 9)

- On January 30, 2024, unauthorized parties drained approximately 213 million XRP — valued at roughly $112.5 million at the time — from personal XRP accounts belonging to Chris Larsen. The theft was first detected not by Larsen's own security team but by the crypto exchange WhiteBIT, which alerted his team to suspicious deposits on January 30. On-chain investigator ZachXBT publicly identified the breach in a Telegram post, flagging suspicious transfers of XRP from the wallet rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm, which was activated on November 5, 2018, and can be traced back through on-chain ancestry to an account created by Larsen in February 2013. According to monitoring by Lookonchain, four of Larsen's wallets were compromised, with a total of approximately 237.68 million XRP (roughly $117.4 million) stolen. Of that total, approximately 212.68 million XRP was transferred to exchanges for laundering, while roughly 25 million XRP remained in an intermediate wallet identified by the partial address rHVjfY. The theft occurred across 8 transactions over approximately 11 hours, beginning at 11:12 UTC on January 30, 2024, and concluding at approximately 22:23 UTC the same day. Larsen publicly confirmed the breach on January 31, 2024, stating on X (formerly Twitter): 'Yesterday, there was unauthorized access to a few of my personal XRP accounts (not @Ripple) — we were quickly able to catch the problem and notify exchanges to freeze the affected addresses. Law enforcement is already involved.' Ripple CEO Brad Garlinghouse simultaneously confirmed that no Ripple-managed wallets were compromised.+ 

(section 10)

- On-chain forensics conducted by ZachXBT and subsequently by blockchain security firm Hacken identified several XRP Ledger wallet addresses involved in the theft and laundering. The primary compromised wallet from which funds were initially drained is rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm. According to Hacken's analysis, the attacker split the stolen funds across eight different intermediate wallet addresses. Hacken's researchers identified the following first-tier distribution wallets used by the attacker: rGhR13XyM43WdDaSMznHd5rZ4cJatybvEg, rHQVKntyfkDCPhEBL2ctryuEAkDZgckmmV, rLsUemhuBZtF44rqqzneb2F9JgyrRYYd4t, rKPERax7t9iFvT3RHXn5nifyNpzp9a4hBa, and rpjs4HLX1gJoEenH69PsQmXaXY22QhCYAT, among others. Six of these intermediate wallets subsequently consolidated funds to a single address beginning with rHyqB, which then forwarded approximately $70.9 million worth of XRP to an address beginning with ro4ha. Approximately 25 million XRP was held in the wallet identified by the partial address rHVjfY. Hacken also flagged a wallet partially identified as rU1bPM4 as having 'longstanding ties with XRP,' noting it had previously sent $64.6 million worth of XRP to Larsen and made a $37,500 transaction with one of the attacker's intermediate wallets. Hacken stated that 'two wallets connected to XRP's authorized wallet played key roles' in the incident and suggested the attack 'might have been an inside job,' though the firm explicitly stated that conclusions were premature. The subsequent U.S. government forfeiture complaint (March 2025) attributed the theft to the 2022 LastPass breach rather than insider access. No ETH addresses have been verified by Tier 1 or Tier 2 sources as part of this specific theft.+ 

(section 11)

- The stolen XRP was laundered through at least seven major cryptocurrency exchanges: MEXC, Gate.io, Binance, Kraken, OKX, HTX, and HitBTC. WhiteBIT was the first exchange to identify and flag suspicious incoming deposits. Following notification by Larsen and Ripple, Binance announced on approximately February 2, 2024, that it had frozen $4.2 million worth of stolen XRP. Binance CEO Richard Teng (who succeeded Changpeng Zhao after CZ's November 2023 resignation) stated: 'We will continue to support Ripple in their investigations and their efforts to retrieve back the funds, including closely monitoring the majority of funds still in the exploiter's external wallets in case they deposit to Binance.' Representatives for Binance and Kraken confirmed cooperation with investigators. The $4.2 million frozen by Binance represented approximately 3.75% of the original $112.5 million stolen. Between June 2024 and February 2025, U.S. law enforcement traced and seized $23,604,815.09 in cryptocurrency from the following exchanges: OKX, Payward Interactive (dba Kraken), WhiteBIT, AscendEX Technology SRL, Ftrader Ltd (dba FixedFloat), SwapSpace LLC, and Rabbit Finance LLC (dba CoinRabbit). The total amount recovered as of the March 2025 forfeiture complaint stood at approximately $23.6 million out of the $150 million valuation cited in the complaint.+ 

(section 12)

- On March 6–7, 2025, ZachXBT disclosed the contents of a U.S. government civil forfeiture complaint filed in the Northern District of California, which identified the root cause of the January 2024 theft. The complaint alleged that private keys to Larsen's XRP wallets had been stored in an online password manager account — identified by investigators and independent researchers as LastPass — that was compromised during the 2022 LastPass data breaches. LastPass suffered two significant security incidents: one in August 2022 and another in November 2022. During those breaches, attackers stole copies of encrypted customer password vaults. Investigators believe the attackers subsequently cracked the master passwords for certain accounts through offline brute-force attacks, gaining access to stored credentials including crypto private key material. The forfeiture complaint noted that no evidence of direct device compromise was found in connection with Larsen's theft, pointing to the password manager breach as the sole entry point. Security researcher Brian Krebs, citing both the complaint and prior research by Nick Bax and Taylor Monahan, reported that this pattern matched at least dozens of prior six-figure and seven-figure crypto thefts across multiple victims who had stored seed phrases in LastPass's 'Secure Notes' feature. ZachXBT noted that Larsen had not previously disclosed the cause of the breach publicly; the forfeiture complaint marked the first official attribution. LastPass has continued to state that it has 'not been made aware of any conclusive evidence that connects any crypto thefts to our incident.' The complaint also noted that an associate who managed Larsen's wallets stored the private keys in the password manager — a detail that complicated questions of sole responsibility.+ 

(section 13)

- Separately from the 2024 hack, Chris Larsen was named as a defendant in a landmark U.S. Securities and Exchange Commission enforcement action. In December 2020, the SEC filed suit against Ripple Labs, CEO Brad Garlinghouse, and co-founder Chris Larsen, alleging that Ripple had conducted an unregistered securities offering through XRP sales totaling approximately $1.3 billion. In October 2023, the SEC dropped all individual charges against Larsen and Garlinghouse following a partial summary judgment ruling in which Judge Analisa Torres found that programmatic XRP sales on exchanges did not constitute securities transactions, while certain institutional sales did. A final settlement between the SEC and Ripple Labs was reached in 2025, with Ripple agreeing to pay $50 million — a fraction of the approximately $2 billion penalty originally sought — with $75 million in previously escrowed funds returned. The parties filed a joint stipulation of dismissal on August 7, 2025, formally closing the case. The SEC litigation did not result in any finding that XRP itself constituted a security in all contexts, and Larsen personally was cleared of all charges.+ 

(section 14)

- News of the theft caused XRP's price to fall approximately 5% on January 31, 2024, as initial reports — including ZachXBT's first Telegram post — did not distinguish between Larsen's personal accounts and Ripple's corporate treasury. Speculation briefly circulated that Ripple's network or escrow had been compromised. Larsen and Garlinghouse moved quickly to clarify the scope, which partially stabilized market sentiment. The incident highlighted the disproportionate risk carried by high-net-worth crypto insiders who self-custody large personal holdings without enterprise-grade security practices such as hardware security modules (HSMs), multi-signature authorization, or segregated key management. Despite the breach, Larsen's remaining personal XRP holdings — estimated at 2.5–2.7 billion tokens — were unaffected, and Ripple's own treasury and operations were not impacted.+