XRP Healthcare to Shut Down After $452K Wallet Breach Hits 4,011 Users
Highlights
- XRP Healthcare is shutting down after a weak key-generation flaw drained ~$452K from 4,010 XRPH Wallet accounts on September 3.
- The bug shrank the wallet's keyspace from 2^128 to ~2^46, letting an attacker reproduce private keys and sweep XRPH, XRPHAI, and XRP.
- XRPH and XRPHAI face orderly delisting; anyone who generated keys in XRPH Wallet must treat that seed phrase as permanently compromised.
XRP Healthcare is winding down all operations after a coding flaw inside its XRPH Wallet application drained approximately $452,000 from 4,011 user accounts on September 3, 2026.
The project has confirmed the orderly delisting of its XRPH and XRPHAI tokens, with individual exchange deadlines still to be set.
How a Wallet Bug Brought Down the Entire Project
XRP Healthcare was a healthcare-focused project built on the XRP Ledger (XRPL). It issued two tradeable tokens, XRPH and XRPHAI, and operated its own XRPH Wallet application.
The project halted new XRPH staking in 2024 amid a supply squeeze, and later joined XRPL as a validator node.
It also pursued a UAE trademark expansion. Despite three years of development, a public-listing effort never completed.
On the evening of September 3, a new collector address began sweeping XRPH Wallet balances. Largest accounts were targeted first. By roughly 22:30 UTC, the collector had already absorbed more than 242,000 XRP.
On-chain analytics platform XRPL.to later counted 10,281 payments from 4,011 sender wallets. One sender funded the collector address.
The remaining 4,010 wallets are classified as victims. In total, the attacker took approximately 267,664 XRP, 23.2 million XRPH, and 2.43 million XRPHAI, worth an estimated $450,000–$452,000.
The root cause was a weak key generation flaw. XRP Healthcare’s developer report found that the XRPH Wallet app passed a 55-character value into the XRPL key function, but only the first 16 characters were effectively retained.
This shrunk the wallet’s effective keyspace from the intended 2^128 to roughly 2^46, about 72.9 trillion combinations.
Developers reproduced private keys for nine live wallets, including four confirmed drained accounts, using only public information and a partial keyspace scan.
Stolen funds did not stay on the XRPL. They moved through NEAR Intents, crossed to Ethereum via Uniswap V4, and settled as approximately 445,198 DAI in a single Ethereum address.
As of the last public update, the funds had not moved. This pattern of cross-chain fund movement mirrors the GoMining coordinated wallet drain, where stolen funds were also consolidated and bridged to Ethereum.
The same weak entropy failure class previously appeared in the Coldcard Bitcoin wallet hack, where losses exceeded $100 million.
What XRPH and XRPHAI Holders Must Do Now
On September 10, XRP Healthcare published its official wind-down statement. It confirmed orderly delistings of XRPH and XRPHAI with exchange partners still setting individual withdrawal deadlines.
The XRPH Wallet apps remain offline. IP and global trademarks are retained separately. This is not an XRP Ledger protocol failure. The XRPL chain itself was not compromised.
The same week, the XRP Ledger is preparing a major v3.4.0 upgrade with a lending protocol, and a new Permission Delegation security amendment has gained validator support.
The XRPH shutdown is an application-layer failure on top of a functioning chain.
For token holders, the critical action is binary. Anyone who ever generated keys inside XRPH Wallet should treat that seed phrase as permanently compromised. Simply importing the same seed into new software does not fix the problem.
The weakness lives in how the key was originally generated, not where it is stored. Users with any remaining on-chain balances must move them using newly created keys in a separate, unaffected wallet.
XRP Healthcare says recovery work will continue alongside the wind-down. The company is working with exchanges, platforms, and authorities.
It has asked affected users to submit factual reports on Etherscan using transaction records from their drained wallets.
This incident also underscores a wider pattern in 2026. App-layer entropy failures, not L1 consensus bugs, have become the dominant attack vector in crypto wallet security.
The Humanity Protocol private-key exploit and the GoMining cluster drain both followed a similar path. Meanwhile, the broader XRPL ecosystem continues building. Ripple Treasury is nearing $13T in institutional milestone.
That is the institutional XRP book, separate from the app-layer risks that just closed down XRP Healthcare.
For a curated selection of tokens on presale, visit our regularly updated presale list.
Instant Currency Exchange at BestChange with Ease
- Compare Rates Across 1000+ Exchanges
- Access 250+ Cryptocurrencies & Pairs
- Save Time with Real-Time Price Tracking
- Trusted & Verified Exchange Listings
Why Trust CoinGape
CoinGape has covered the cryptocurrency industry since 2017, aiming to provide informative insights Read more… to our readers. Our journal analysts bring years of experience in market analysis and blockchain technology to ensure factual accuracy and balanced reporting. By following our Editorial Policy, our writers verify every source, fact-check each story, rely on reputable sources, and attribute quotes and media correctly. We also follow a rigorous Review Methodology when evaluating exchanges and tools. From emerging blockchain projects and coin launches to industry events and technical developments, we cover all facets of the digital asset space with unwavering commitment to timely, relevant information.
Delivered every day.
- Insights that move markets
- 100,000 active subscribers
Global Onchain Awards 2026
