XRP Healthcare winds down after wallet flaw drains $450K

XRP Healthcare is winding down operations after a security flaw in its XRPH Wallet allowed an attacker to sweep roughly $450,000 from thousands of accounts. The company told affected users to stop using seeds generated by the app and to move any remaining funds to new keys.

The incident began on Sept. 3 and was traced over the following day to 10,281 payments originating from 4,011 sender wallets. Analysts classified 4,010 of those wallets as victims after one sender was found to have funded the collector account. Investigators reported about 267,664 XRP, 23.2 million XRPH and 2.43 million XRPHAI moved into an identified collector, valuing the stolen assets at roughly $450,000 to $452,000. Recovery work traced the funds to an Ethereum address holding about 445,198 DAI, though the attacker’s full conversion path beyond that address remains unproven.

XRP Healthcare’s internal review found the breach resulted from how XRPH Wallet generated credentials. The wallet passed a 55-character string into xrpl.Wallet.fromEntropy(), a function that expects raw bytes, and only the first 16 characters were effectively used. That error reduced the intended keyspace of 2^128 to about 2^46, roughly 72.9 trillion combinations. Developers also identified use of Math.random(), which could have further reduced the practical search space.

Using public data and a partial scan of the reduced keyspace, the development team reproduced private keys for nine live wallets, including four confirmed drained accounts. The company’s findings indicate the exploit can be explained by the seed-generation defect without requiring access to user devices or a failure of the XRP Ledger protocol.

XRPH Wallet applications have been taken offline. XRP Healthcare will retain its intellectual property and trademark portfolio while winding down and plans to delist its tokens, including XRPH and XRPHAI; individual exchanges will set withdrawal deadlines. The company attributed the shutdown to financial and operational pressures, citing development costs, a prolonged crypto bear market and an unsuccessful effort to list publicly.

XRP Healthcare said it will continue to work with exchanges, platforms and authorities and will preserve technical and transaction records related to the incident. Affected users were asked to submit factual reports on Etherscan using transaction records from their drained wallets to support tracing and potential recovery efforts.

The company attributes the loss to credential-generation errors in the XRPH Wallet code, not to a systemic failure of the XRP Ledger.