On 2026-10-24 my PC was compromised by ClickFix malware (C2 45.115.27.10, Kyiv, Ukraine; see my earlier Chainabuse report 3e0f091c-b255-4901-ae8d-7f183b19ae97 for the same incident's EVM/Solana addresses). The attacker hijacked my Google account, found my Ledger hardware-wallet recovery seed in my cloud files, and swept the wallet the same night: XRP: 115,378.335 XRP stolen 22:25:10 UTC from my address rMQT4gQz1cLH6xsGA6gUdtvAxRQNFeRq8p to r9b61aVdUHStCB7zczi9o3FUC77M2Vt1xx, tx 5BD8A741BDEA0135B7B758C167B941BEEDDBB32C0712E0A049E96EFD5B4D0E63. On 2026-10-25 it was split to the four other r-addresses in this report (82,809 / 30,784 / 854 / 930 XRP; no destination tags yet, i.e. not yet deposited at an exchange). BTC: 0.60328552 BTC stolen 22:29:45 UTC in tx 9938d85ca8b865cc17ef304f0b2e18aca435d86c5b569a53b47af7f677f4cd65 (all four addresses of my Ledger BTC account emptied in one transaction) to bc1qa2mq7fqwrw9z2qsah8hqnv28f30pnvgxryktur, then split on 2026-10-25 (tx a7153a43a5cdbe8fdc993820442e438ef30f9e0bf8610841078a3503f678659a) to the bc1q addresses in this report. Loss in this report approx. USD 198,222 (combined incident approx. USD 215,658). Native-key transfers = attacker holds the stolen seed. Reported to FBI IC3 (complaint f8f0710d2f3045ac84ceaca31d02c1be plus supplement filed 2026-11-03) and Policia Civil de Pernambuco, Brazil (B.O. 20261027F63FFED9D). Funds are being tracked; please flag these addresses so any exchange deposit is held pending law-enforcement contact.