XRP Healthcare is Winding Down After Wallet Breach

A Security Failure That Broke the Business

XRP Healthcare, a healthcare platform built on the XRP Ledger, is winding down after a wallet security failure pushed an already strained operation past its limits. The project said the September 3 XRPH Wallet incident added financial and operational pressure to a business already burdened by development costs, a prolonged crypto bear market, and an unsuccessful public-listing effort.

The breach affected a total of 4,011 wallets, with approximately $452,000 in digital assets stolen. Assets included 267,664 XRP, 23.2 million $XRPH, and 2.43 million $XRPHAI. According to analytics platform xrpl(.)to, the breach unfolded rapidly over a three-hour period on September 3, 2026. The attacker's wallet, created only an hour before the theft, received the full balance of the 4,011 affected wallets.

A flaw in XRPH Wallet reduced its keyspace to about 2^46, enabling a sweep of roughly $450,000 from thousands of accounts. Independent technical claims blamed weak seed generation, not an underlying XRP Ledger protocol failure. Researchers examining XRPH Wallet found that its staking function transmitted a user's seed phrase to an XRP Healthcare server when staking or unstaking. Of the affected wallets examined, 1,199 had used the staking feature. That finding does not explain the full breach because nearly 70% of the drained wallets had not staked.

Funds Traced, Recovery Uncertain

Of the stolen funds, 311,613 XRP was processed through NEAR Intents, converted to 178.46 ETH on Ethereum within minutes, and ultimately swapped into 445,198 DAI, all centralized in a single address that remains untouched. The DAI remained unmoved when investigators published their findings, leaving the funds visible through blockchain records.

No bankruptcy filing, liquidation petition, or court-supervised insolvency process accompanied the announcement. XRP Healthcare described the action as an "operational wind-down," which does not by itself establish the company's legal status or how creditor claims would be handled. The company says $XRPH and $XRPHAI delistings are being coordinated separately with exchange partners.

XRP Healthcare has advised affected users to abandon credentials generated through XRPH Wallet and move any remaining assets using newly created keys. The company said it will continue working with exchanges, platforms, authorities, and other parties while preserving technical and transaction records connected to the incident. XRP Healthcare did not announce a reimbursement program, payment schedule, or confirmed freeze. Readers should therefore separate "traced" from "recovered": the first describes investigators locating assets on a public ledger, while the second would require the company or users to regain control.

Sources:
crypto.news: XRP Healthcare shuts down after $452K wallet incident
CryptoSlate: XRP project shutting down after wallet flaw exposed 4,000 accounts
XRPL.to: The XRPH Wallet Hack: 4,011 Wallets Emptied in Three Hours