Security

Chris Larsen XRP Theft: The Reported LastPass Link Explained

Ripple co-founder Chris Larsen lost about $150 million in XRP in 2024. What the reported LastPass link and the exchange trail mean for XRP holders.

Video: Chris Larsen XRP Theft: The Reported LastPass Link Explained

Key takeaways

  • The January 2024 theft hit a few of Chris Larsen's personal XRP accounts, not Ripple itself, according to Larsen.
  • Investigators believe the theft is linked to the LastPass breach. LastPass disclosed in December 2022 that backups of customers' encrypted vaults had been copied.
  • According to the video, ZachXBT's advice after the theft was never to store a private key in a password manager or back up a wallet to the cloud.
  • Binance froze about $4.2 million soon after the theft, and US authorities moved in March 2025 to seize about $23 million. Both are far short of the roughly $150 million taken.
  • The video's central point is that every coin someone sells, someone else buys. Having a plan before a scary headline or a rally matters more than timing.

Ripple co-founder Chris Larsen lost about 283 million XRP, worth roughly $150 million, when his personal accounts were drained on January 30, 2024, according to the video. Larsen said Ripple itself was not hacked. Investigators believe the thieves got in using data from the 2022 LastPass breach, in which hackers copied backups of customers’ encrypted password vaults.

The case matters to ordinary XRP holders for two reasons. First, it suggests that even one of the earliest and largest XRP holders can lose coins when sensitive secrets sit in a password manager. Second, the stolen coins went straight to exchanges. The video argues that ordinary people buying the dip were probably on the other side of those trades. It uses the episode to ask who you are buying from, and whether you are buying with a plan.

Who is Chris Larsen?

Chris Larsen is a co-founder of Ripple and its executive chairman. He was the company’s first chief executive. According to the video, he helped start Ripple in 2012 and held one of the largest piles of XRP in existence for years. The video also says Forbes once called him the richest person in cryptocurrency. In a 2018 clip shown in the video, he described Ripple’s goal as “wiring an internet for money.”

The video’s point is simple: if anyone knew how to look after coins, you would expect it to be him.

What happened on January 30, 2024?

On January 30, 2024, with XRP trading at about 50 cents, coins began leaving Larsen’s accounts. The next day, the blockchain investigator ZachXBT, who traces stolen coins from wallet to wallet in public, posted that Ripple appeared to have been hacked for about 213 million XRP. He listed where the coins were going: MEXC, Gate, Binance, Kraken, OKX and others.

CNBC reported that around $112 million in XRP appeared to have been stolen, and that speculation about a Ripple hack sent the price down. Larsen then said on X that a few of his personal accounts had been accessed, not Ripple itself. He said the problem was caught quickly, exchanges had been asked to freeze the addresses, and law enforcement was involved.

The freezes caught very little. Binance froze about $4.2 million out of more than $100 million. By then, most of the coins had already been moved on. XRP fell about 5%, to as low as $0.49, according to the video.

Our explainer on whether XRP can be frozen covers why exchanges can lock funds they hold, while XRP on the ledger itself works differently.

How did the thief get in?

Investigators believe the way in was LastPass, a password manager. A password manager is an app that stores all your passwords in one encrypted vault. On December 22, 2022, LastPass said an attacker had copied a backup of customer vault data. The attacker had broken into its cloud storage using information stolen in an earlier incident in August 2022. Security experts have said they believe some of those stolen vaults were later cracked.

For more than a year, there was no public explanation of how Larsen’s accounts were accessed. That changed in March 2025, when the US Justice Department filed a civil forfeiture complaint to seize about $23 million in cryptocurrency. Federal investigators linked those funds to the January 2024 theft, a connection reported by Krebs on Security. According to the video, the full count of stolen XRP came to about 283 million.

So the door was reportedly opened in 2022, and the coins left in January 2024. According to the video, ZachXBT’s advice afterwards was blunt: never store your private key in a password manager or back up your wallet to the cloud.

In December 2025, the UK Information Commissioner’s Office fined LastPass UK Ltd £1.2 million over the 2022 breach. The video sets that penalty against a loss of roughly $150 million from this one victim alone.

Our guide to the places private keys leak covers similar cases.

Who bought the stolen XRP?

The video says ordinary buyers on exchanges probably bought some of the stolen XRP. Its recurring line is that every coin someone dumps, someone else buys. A thief who sends coins to an exchange is trying to swap them quickly for something else, and every swap needs someone on the other side.

The thief was patient getting in and impatient getting out. The video does the math: 283 million XRP at about 53 cents is roughly $150 million. XRP reached a record of about $3.65 on CoinGecko in July 2025. At that price, the same coins would have been worth about $1 billion. The video’s point, made with hindsight, is that the thief sold near the bottom. Anyone who happened to buy those coins near 50 cents captured the later rise instead.

What did Larsen’s wallets do near the 2025 top?

In July 2025, ZachXBT reported that an address linked to Larsen had transferred out 50 million XRP since July 17, worth about $175 million. About $140 million of it ended up at exchanges and services. By ZachXBT’s count, the wallet linked to Larsen still controlled about 2.8 billion XRP.

The video is careful here. Sending coins to an exchange is not proof of a sale. It does note the contrast: 50 million of Larsen’s coins near the top were worth more than all 283 million the thief took near the bottom. According to the video, many ordinary buyers in July 2025 were paying around $3.50.

The video is also fair to Larsen. It points out that he held XRP from the start, and that reducing a position after more than a decade would be understandable if that is what happened. It adds that nobody times the market perfectly.

Where does that leave the numbers now?

According to the video, CoinGecko showed XRP at about $1.30 on October 18, 2026. At that price, anyone who bought around $3.50 is sitting on a large loss. The thief’s roughly 283 million XRP would be worth about $370 million, not $1 billion.

Moment Approx. XRP price Value of 283 million XRP
Theft, January 2024 about $0.53 about $150 million
Record high on CoinGecko, July 2025 about $3.65 about $1 billion
October 18, 2026 (CoinGecko, via the video) about $1.30 about $370 million

Lessons for your own setup

The video draws a few practical lessons from the theft that any holder can apply:

  1. Keep private keys and recovery phrases out of password managers. According to the video, that is ZachXBT’s direct advice, and a password manager breach is the reported way in here. Our guide on what a seed phrase is and how to protect it explains the alternatives.
  2. Don’t back up wallets to the cloud. The reasoning is the same: a copied backup can be cracked long after the breach.
  3. Don’t count on freezes or seizures. Binance froze about $4.2 million soon after the theft, and the later US seizure covered about $23 million. Both are a fraction of the roughly $150 million taken.
  4. Know who is on the other side of your trade. Heavy selling on bad headlines and large exchange inflows near records both mean someone is selling to buyers.
  5. Decide your plan before the price moves. The video argues that the people who come through stories like this are not the fastest, but the ones who already know what they will do, whoever is selling.

Large holders may also want to work through our XRP security checklist for large holders.

What to watch next

Check where every recovery phrase and private key you own is actually stored, and whether any copy sits in a password manager or cloud backup. Watch for further developments in the US forfeiture case linked to the theft. Treat any report of a large wallet sending XRP to exchanges as a prompt to review your own plan, not as proof that someone sold.

Frequently asked questions

Was Ripple hacked in January 2024?

No. Ripple co-founder and executive chairman Chris Larsen said a few of his own personal accounts had been accessed, and that Ripple itself was not hacked. Early speculation about a Ripple hack still helped push the XRP price down about 5%.

How much XRP was stolen from Chris Larsen?

Early reports, starting with blockchain investigator ZachXBT, put the figure at about 213 million XRP, or roughly $112 million. According to the video, the full count later came to about 283 million XRP, worth roughly $150 million at around 53 cents.

How did the thief get into Chris Larsen's accounts?

Investigators believe the thieves used data from the LastPass breach. In December 2022, LastPass said hackers had copied backups of its customers' password vaults, and security experts believe some of those vaults were later cracked.

Was any of the stolen XRP recovered?

Binance froze about $4.2 million shortly after the theft. In March 2025, the US Justice Department filed a civil forfeiture complaint to seize about $23 million in crypto that federal investigators linked to the theft.

Should I keep my crypto private key in a password manager?

According to the video, ZachXBT said after the theft that you should never store a private key in a password manager or back up a wallet to the cloud. In this case, a password manager breach is the reported way in.

Full video transcript

From the video's captions, lightly formatted. Captions can mishear names and numbers, so check figures against the article above.

Somewhere out there, there's a person who walked off with hundreds of millions of XRP belonging to one of the men who started Ripple and pushed it through at least seven exchanges. And plenty of the people on the other side of those trades were probably ordinary holders buying the dip. On the 30th of January 2024, somebody got into the personal XRP accounts of Chris Lson, Ripple's co-founder and executive chairman, and a crypto detective who goes by Zack XBT, watched the coins leave. So listen, XRP holders, a thief stole $112 million of XRP from Ripple's co-founder, and the twist came later, more than a year later. And if you own XRP, the theft from Ripple's co-founder shows exactly who you're buying from.

Because once the full count came in, the stolen XRP was worth about $150 million. And at the 2025 peak, those same coins were worth about a billion. And if you've never heard of Zack XBT, he's basically a one-man detective agency for crypto because he follows stolen coins from wallet to wallet out in the open and posts what he finds for anyone to see. And there's a link at the top of the description and I'll tell you what it's for once you've heard how this one ends because the endings the bit that matters. My name's Rory.

I've been trading crypto and forex since 2020, and it's given me a full-time income and the freedom to travel the world while I do it. And by the end of this, you'll know how a thief got into a billionaire's accounts and why his coins ended up with ordinary people at 50 cents. What happened to Larsson's own XRP when the price hit the top and who actually came out of it with the money? Like if you're bullish, let's run it. [music]

Hey bull runners, welcome back. So who actually is Chris Lson? Well, he's one of the people who started Ripple back in 2012. He was its first boss, and he held one of the biggest piles of XRP on the planet for years. Forbes once called him the richest person in cryptocurrency.

And here's how he talked about it in 2018.

But fundamentally, it's about wiring an internet for money. This is almost like 1994, uh, the first days of the the data internet,

an internet for money. And whatever you think of Ripple, Larsson was holding XRP before most of us had even heard of it. So if anybody on Earth knew how to look after coins, you'd think it would be him, wouldn't you? Hold that thought. So it's the 30th of January, 2024, and XRP's sat at about 50 cents and coins start pouring out of Len's account.

The next day, Zack XPTt posts that it looks like Ripple's been hacked for about 213 million XRP, and he lists where the coins are going. MEXE, Gate, Binance, Kraken, OKX, and more. And that to me is the bit people miss because it's a thief sending coins to an exchange. He's not keeping them, is he? He's swapping them for something else as fast as he can.

And every swap needs somebody on the other side of it. And CNBC had it on the next morning.

Blockchain Sloo Zack XBT pointed out in a post on X that around $112 million in XRP had seemingly been stolen on Tuesday. [music] Speculation that the Ripple platform had been hacked sent the price of XRP tumbling. But in a post on X this morning, Ripple co-founder Chris Lson clarified that it was his own personal accounts that had been accessed, not a hack of Ripple itself.

So, it was his own personal accounts, not Ripples. Larsson posted that they caught it quickly, told the exchanges to freeze the addresses, and the police were involved. And Binance did freeze about $4.2 million of it. 4 million out of over 100 million. The rest had gone, hadn't it?

And XRP itself dropped about 5% as low as 49. And listen to me on this because it's the whole story in one line. Every coin somebody dumps, somebody else buys. And at the end of January 2024, the somebody else was ordinary people sat at home seeing XRP down 5% and thinking, well, that's a nice little dip. And some of them without knowing it were buying coins that had just come out of a billionaire's account from a thief who take whatever price he could get.

So, pause it for a second and have a guess. How do you think they got in? Was it a dodgy email, a fake app, or a text pretending to be the bank? Because for over a year, nobody outside really knew. Then, in March 2025, the American government filed a court case to take back about $23 million of stolen crypto. and Krebs on security, one of the best known security reporters around, tied that case to $150 million theft from January 2024.

And the full court came out at about $283 million XRP. And the door they came through wasn't an email at all. It was Last Pass. And if you don't know Last Pass, it's a password manager. So think of it as one app that keeps all your passwords in a lock box.

And back in December 2022, Last Pass told the world hackers had copied backups of its customers locked boxes. And the reporting is that the thieves then work through cracking them one by one. So the door got opened in 2022 and the coins went out in January 2024, more than a year later. And Zack XPTt didn't hold back because he said straight out, never store your private key in a password manager or back your wallet up to the cloud. Which is crazy because Last Pass got fined around 1.2 2 million over that breach in the UK in December 2025.

And that's against $150 million from just one victim. But here's what really got me about the story. The thief was patient going in. More than a year sat on those copied vaults and then not patient when coming out because the coins went straight to the exchanges about 50. So do the quick sum with me.

283 million XRP at about 53. That's your 150 million. Then in July 2025, XRP hit its record about $3.65. And the very same coins would have been worth about a billion dollars. Every coin somebody dumps, somebody else buys.

So whoever picked those coins up at 50 in early 2024 and just sat on them without knowing where they'd come from, was the one who got paid for the patience. Not a thief. Him or her, the ordinary holder who didn't panic. And this is where the story turns right round on itself. July 2025 comes.

XRP's flying towards that record. Every headline streaming about it and Zack XBT spots something else. From the 17th of July, an address linked to Chris Lson sent out 50 million XRP. About $175 million worth and about 140 million of it ended up at exchanges and services. And by Zach XPTt's count, wallets linked to Larsson had about 2.8 billion XRP left on top of that.

And I'll be straight with you, sending coins to an exchange isn't proof somebody sold. But look at the numbers side by side. 50 million of Larsson's coins near the top were worth more than all the 283 million the thief took near the bottom. And who was on the other side? Well, in July 2025, plenty of ordinary people were piling in at around $3.5.

So, the thief let the coins go far too early and Larsson's coins hit the exchanges near the top. Every coin somebody dumps, somebody else buys. And the whole question is whether you're buying because you've got a plan or just because the price is moving. But let's be fair about it. Len was in XRP from the very start.

And taking some off the table after holding for over a decade near a record is what plenty of sensible people would do if that's what it was. And nobody times it perfectly. Not him, not a thief, and definitely not me. And look at what happened next. Because on the 18th of October 2026, Coin Gecko had XRP at about a $130, nearly 23 off that top.

So anybody who bought in at 3.5 is sat on a big loss. And even the thief's 280 million would be worth about 370 million at that price, not a billion. So tell me in the comments, were you buying XRP in early 2024? Yes or no? Because if you were, there's a chance some of your coins came from that thief.

And I get it because the hard bit was never knowing what to buy, was it? It's sitting there when it drops 5% on a scary headline and sitting there again when it's flying and everyone at work suddenly is an expert. Because when you've got real money in this money for a wedding, you're helping pay for a car that's on its last legs or just a bit of breathing room, every big move feels like it's testing you personally. And that's not you being weak. That's just what it feels like when nobody's shown you how to have a plan.

And the ones who come out of a story like this, all right, usually aren't the fastest. They're the ones who knew what they do, whoever was selling. There's a member of ours called James who came to us with a $20,000 bill from the IRS for back taxes from early years. The team took him through a framework. He stuck to it with the portfolio he was building, and he paid off that whole 20 grand.

Then on top of that, he bought his first ever house. Everyone's results are different and I can't promise you what James got, but the people inside come from every sort of background. Plenty of them just looking after what they've spent years building and they get a weekly call where they can put their questions to our research team and a coach of their own onetoone. So, am I telling you to buy XRP? Well, no. there may be better opportunities for your situation.

But if you've got real money in this and nobody's ever sat down with you and gone through what you actually hold, how it's stored, and what you'll do the next time the coins come flooding onto the exchanges, that's what the call's really for. I've done well in crypto in my own right, and the thing that properly sped me up was the team we built at Altcoin Pro, and that's who you'd be talking to. Just click the first link in the description, watch the short video, press the button underneath it, fill in the short form, and book your free 15-minute call. And if you're watching this on your phone, just tap more under the video. And the link's right there at the top.

It's for people holding $50,000 or more in crypto that's just sitting there. And if you're already well set up, they'll tell you that, too. And the Fed's minutes from its late October meeting come out on the 18th of November. And days like that can move the whole market either way. So get your call booked in before then because the thief had all the patience in the world going in and none coming out.

And Lson had the coins and the only person in this story with no say in any of it was the one clicking by. So don't be the one buying blind. And look, none of this is financial advice, guys. It's just my take after a lot of digging. Crypto carries risk and what's happened before is no guarantee of what comes next.

So stick with me, subscribe, and there's a new one every day. Thanks for watching, guys. Keep your head stacked with purpose and I'll keep you posted.

Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures and quotes are as reported in the video on October 31, 2026 and may have changed since.