XRP Healthcare Winds Down After Wallet Flaw Drains 4,011 Accounts

XRP Healthcare is winding down its normal operations after a wallet-generation flaw exposed thousands of XRPH Wallet accounts and helped turn a security failure into an existential blow for the project.

The company said the September 3 incident affected 4,011 wallets and removed roughly $452,000 in XRP, XRPH and XRPHAI. Its investigation concluded that the app fed improperly formatted entropy into the XRP Ledger key-generation function, sharply reducing the effective keyspace and making it practical to reconstruct private keys offline.

That distinction matters. This was not evidence of a break in the XRP Ledger itself.

The failure was in the wallet software used to create and protect account keys—exactly the layer users trusted to keep those keys unpredictable.

According to CryptoSlate, XRP Healthcare’s technical review reproduced the defect and traced it to improperly formatted entropy passed into the XRP Ledger key-generation function. The defect had been present since June 2023, sharply reducing the effective keyspace and making offline reconstruction of private keys computationally feasible.

The report said the company took the apps offline, began coordinating exchange delistings for XRPH and XRPHAI, and committed to continue recovery work even as normal operations wind down. That sequence turns the story from a temporary app outage into a full operational reckoning.

XRP Healthcare also said its financial pressure predated the breach, pointing to sustained development costs and an unsuccessful public-listing process. The September incident added recovery, investigation and reputational costs at the worst possible moment.

A separate XRPL.to forensic analysis followed the activity across the ledger and reported that 267,664 XRP and about 23.2 million XRPH were swept from affected wallets. Investigators found that the sweep began late on September 3, moved the largest balances first, and reached the DAI conversion on Ethereum in just over three hours.

The review found that the transactions were ordinary, validly signed payments. The ledger processed instructions from compromised keys; it did not bypass its own signature rules.

The same analysis traced the route through NEAR Intents and into Ethereum, where the assets were converted into approximately 445,198 DAI. XRP Healthcare later published the destination address and asked affected users to submit factual reports tied to their losses.

COMMUNITY ACTION — HELP FLAG THE STOLEN FUNDS ADDRESS

The stolen funds from the XRPH Wallet security incident have been traced end-to-end and approximately 445,198 DAI remains in the final Ethereum address below.

Final address:
0x3DC7BFf29Fc5a051aAB250516BaBD74ae7068930… pic.twitter.com/Bm6XroWuNG

— XRP Healthcare (@XRPHealthcare) September 6, 2026

XRP Healthcare said the breach arrived after a prolonged bear market, heavy development and infrastructure spending, and the cost of pursuing a public listing process that did not reach completion. The company has now begun coordinating an orderly delisting of XRPH and XRPHAI with exchange partners.

Holders will need to follow each exchange’s official withdrawal instructions and deadlines. The XRPH Wallet applications are staying offline, and the company said it will retain its intellectual property and trademark portfolio separately from the operational wind-down.

XRP HEALTHCARE — OPERATIONAL WIND-DOWN

After nearly three years of building XRP Healthcare, we have made the difficult decision to begin winding down the company’s normal operations.

This decision has not been taken lightly.

Over the past three years, we have continued…

— XRP Healthcare (@XRPHealthcare) September 10, 2026

The XRP Ledger’s consensus and transaction rules cannot protect a user when wallet software produces guessable keys. That is why this incident should not be described as an XRPL protocol exploit—and why it still deserves close attention from everyone using third-party XRP tools.

Wallet audits need to examine key generation, entropy handling and build provenance alongside basic send-and-receive functions. Users also need a migration path that does not require reopening compromised software or trusting unsupported instructions circulating on social media.

The immediate story is the loss and the wind-down. The longer-term story is whether affected users recover any of the traced DAI—and whether other wallet developers treat this as a warning before a similar implementation mistake reaches production.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.