Crypto Teacher Sends Critical Warning to XRP Holders

The cryptocurrency community has been examining a recent claim by an investor who said he lost $3 million worth of XRP from his Ellipal cold wallet. This case has led to renewed attention on wallet configurations and user security practices after an image shared by a community member highlighted a key distinction between “cold” and “hot” wallets within the Ellipal app.

James Rule (@RuleXRP), a prominent figure in the XRP community, posted a warning that included a screenshot from the Ellipal mobile interface. The post featured an arrow pointing to the option labeled “Add Hot Wallet,” showing how users can switch between connecting a cold wallet and creating a hot wallet in the same application. He cautioned users by writing, “DO NOT create a HOT WALLET in the @ellipalwallet APP with SEED/RECOVERY Phrases.” He also referred to the man who claimed the loss, alleging that the individual was “shilling a new YouTube Channel focusing on gold and silver.”

Ellipal’s Response

Within hours, the post circulated widely among XRP holders, many of whom questioned how such a large amount could be stolen from a supposedly air-gapped device. Ellipal responded publicly to the growing concern, clarifying that its hardware wallets “are 100% air-gapped and never connect to the internet.”

While Brandon, the man who lost the $3 million, initially stated that the cold wallet on the app functions as a hot wallet, the company explained that the reported issue “came from a hot wallet setup, not from the cold wallet itself.” Its message concluded with a reminder to users to “stay safe and always keep your keys offline.”

Lessons for Crypto Holders

The distinction between wallet types is central to understanding the situation. A cold wallet is designed to remain isolated from any network connection, which prevents online attacks, and crypto experts have consistently advocated that XRP holders store their tokens in cold wallets.

However, once a recovery seed is imported into a mobile or internet-connected app, it no longer functions as cold storage. This transition effectively converts it into a hot wallet, exposing private keys to potential compromise if the device is infected or insecure.

Brandon allegedly imported his seed phrase into the mobile app before the theft occurred, allowing attackers to access the funds remotely. The case remains under investigation, but many market participants believe that the reported vulnerability lies not in the Ellipal device itself but in the configuration choices made during setup.