How a Phishing Email Drained 400,000 XRP From One Holder’s Wallet

An XRP holder lost 400,000 tokens overnight after falling for a phishing email disguised as a routine hardware wallet update, according to an account shared by crypto adviser George Kaltekis.

A Late-Night Call on Easter

That panicked call reportedly came in at 10pm on Easter night, after the theft. Kaltekis said the timing alone signaled something was wrong, since calls at that hour rarely bring good news.

The victim had roughly 400,000 XRP stored on a hardware wallet. While spending the holiday with family, he received an email appearing to come from Ledger, prompting him to update his device. A phishing email disguised as a Ledger update tricked the victim into a mistake, and believing it to be a routine software update, he clicked through and entered his wallet information.

How the Scam Worked

The victim lost 400,000 XRP after clicking a fake software update link at night, unknowingly handing over the credentials attackers needed to drain the wallet. Kaltekis noted that phishing attempts have grown increasingly convincing in recent years, to the point that even people working in cybersecurity professionally have described struggling to distinguish real communications from fake ones.

Not a Total Loss

He still had about 50,000 XRP held safely in a separate insured custody account, funds that remained untouched because that account required additional verification steps before any transaction could be approved, including a callback confirmation and voice verification before funds could move.

A Broader Lesson on Self-Custody

Kaltekis said the story wasn’t meant to discourage self-custody, which he described himself as a strong supporter of. Rather, he said it illustrates that self-custody, while valuable, isn’t inherently foolproof against sophisticated phishing attempts. A single mistake, made under normal circumstances by someone simply checking email, was enough to result in a significant loss.

The account is one of many similar stories circulating within the crypto industry, serving as a reminder for holders of XRP, Bitcoin, and other digital assets to verify unexpected update requests carefully and consider additional safeguards for larger holdings.