Key facts
- XRP Healthcare is shutting down all operations due to a wallet breach.
- A coding flaw in the XRPH Wallet app drained approximately $452,000 from 4,011 user accounts on September 3, 2026.
- The project will delist its XRPH and XRPHAI tokens.
- The root cause was a weak key generation flaw that reduced the wallet's effective keyspace.
- Stolen funds were bridged to Ethereum and settled as approximately 445,198 DAI.
- Users who generated keys within the XRPH Wallet are advised to treat their seed phrases as compromised.
XRP Healthcare is ceasing all operations following a significant security breach that resulted in the loss of approximately $452,000 from over 4,000 user accounts. The incident, which occurred on September 3, 2026, was attributed to a critical flaw in the XRPH Wallet application's key generation process.
The project confirmed the orderly delisting of its XRPH and XRPHAI tokens, with specific exchange deadlines yet to be announced. XRP Healthcare, which aimed to focus on the healthcare sector using the XRP Ledger (XRPL), had been in development for three years but never completed a public listing effort.
The breach began on the evening of September 3, when a collector address started draining balances from the XRPH Wallet. On-chain data revealed that 4,011 sender wallets were impacted, with the attacker absconding with approximately 267,664 XRP, 23.2 million XRPH, and 2.43 million XRPHAI. These funds were subsequently moved off the XRPL, crossing to the Ethereum network via Uniswap V4 and consolidating into a single Ethereum address as roughly 445,198 DAI.
Developers identified the root cause as a weak entropy failure in the key generation function, which limited the effective keyspace from the intended 2^128 to approximately 2^46. This vulnerability allowed for the reproduction of private keys using public information and a partial keyspace scan. This same class of vulnerability had previously been seen in other crypto hacks, including the Coldcard Bitcoin wallet incident.
In a statement published on September 10, XRP Healthcare advised all users who generated keys within the XRPH Wallet to consider their seed phrases permanently compromised and to move any remaining balances using newly created keys in separate, unaffected wallets. The XRPH Wallet applications have been taken offline, though the project's intellectual property and global trademarks are being retained separately. XRP Healthcare stated that recovery efforts are ongoing in conjunction with exchanges, platforms, and authorities.