Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
According to XRP Ledger AI Healthcare Platform, XRP Healthcare, the XRPH Wallet app has been taken offline following a recent security incident.
XRP Healthcare clarified that the removal of the XRPH wallet apps was done by its team as a security precaution after the incident and not by the attacker.
The XRPH wallets still exist on the XRP Ledger, allowing anyone who knows their XRPL address to independently check their balance and transaction history on-chain without the XRPH Wallet app.
Access through the XRPH Wallet app, however, remains disabled while the compromise is investigated.
What happened?
On September 4, XRP Healthcare issued a security update for the XRPH wallet regarding multiple unauthorized transactions affecting users, urging them not to use the wallet until further notice.
XRPH confirmed that 4,011 wallets were affected, with about $452,000 in assets taken. The funds were traced to a single Ethereum wallet where about 445,000 DAI currently sits and has not moved. Its preliminary investigation found no evidence of a fault with the XRP Ledger itself. The exact method by which the wallet keys were compromised is still being investigated, with further verification required.
267,664 XRP stolen
XRP Ledger analytics platform xrpl.to gave a breakdown of the security incident, which it stated happened in three hours.
On the evening of September 3, 2026, an address that did not exist an hour earlier received the entire balance of 4,011 wallets: 267,664 XRP, 23.2 million XRPH and 2.43 million XRPHAI.
A total of 311,613 XRP went into NEAR Intents, came out on Ethereum as 178.46 ETH within a minute of each deposit, and became 445,198 DAI at one address that has not moved since.
According to xrpl.to, XRPH payments are signed on the phone while the seed is stored unencrypted, and the staking feature sends the seed to XRP Healthcare's server.
1,225 wallets staked, nearly all between December 2023 and July 2024. 1,198 of them were drained, and so was XRP Healthcare's own staking wallet, whose key only the server holds. Yet seven in ten victims never staked: the exposure is suggested to be the XRPH app's whole user base, not one feature.
Dan Burgin
U.Today Editorial Team
