XRP Healthcare, a healthcare-focused platform built on the XRP Ledger, is winding down operations after a key-generation flaw in its XRPH Wallet application enabled a sweep of roughly $450,000 from thousands of user accounts on September 3.
In a September 10 statement, the project said the wallet incident added financial and operational pressure to a business already strained by development costs, a prolonged bear market and an unsuccessful public-listing effort. The platform is preparing an orderly delisting of its XRPH and XRPHAI tokens, with individual exchanges expected to set their own withdrawal deadlines. The XRPH Wallet applications remain offline, while the company retains its intellectual property and trademark portfolio.
What the Sweep Looked Like On-Chain
On-chain analytics service XRPL.to traced 10,281 payments from 4,011 sender wallets into a single collector address between September 3 and 4. The service classified 4,010 of those wallets as victims after determining that one sender had funded the collector account.
The consolidated haul amounted to approximately 267,664 XRP, 23.2 million XRPH and 2.43 million XRPHAI — valued at roughly $450,000 to $452,000 at the time.
According to the project's account of the incident, the collector began absorbing balances on the evening of September 3, targeting the largest accounts first.
The Root Cause: 16 Effective Characters
XRP Healthcare's developer findings report traced the breach to how the wallet generated credentials. The application passed a 55-character value into xrpl.Wallet.fromEntropy(), a function that expected raw bytes. Only the first 16 characters were effectively retained, leaving 14 variable digits and reducing the possible input space to about 72.9 trillion combinations — roughly 2^46, down from the intended 2^128.
The report also noted the use of Math.random(), which the developers said could have reduced the practical search space further.
To validate the explanation, the team said it reproduced private keys for nine live wallets — including four confirmed drained accounts — using only public information and a partial scan of the reduced keyspace. The report concludes the defect accounts for the September 3 drain without requiring access to user devices or any compromise of the XRP Ledger protocol itself.
The Recovery Problem Is Structural
The flaw has a consequence that users cannot fix by switching software: a wallet generated inside XRPH Wallet cannot be secured by importing the same seed elsewhere, because the weakness lives in how the key was originally created, not where it is stored. XRP Healthcare has advised anyone who ever generated credentials through the app to treat those seeds as permanently compromised and to move any remaining assets using newly created keys.
The stolen funds did not stay on the XRP Ledger. According to the project's tracing, the assets moved through NEAR Intents, crossed to Ethereum via Uniswap V4 and settled as approximately 445,198 DAI in a single Ethereum address, which had not moved as of the last public update. XRP Healthcare has asked affected users to submit factual reports on Etherscan using transaction records from their drained wallets, and says recovery work with exchanges, platforms and authorities will continue alongside the wind-down.
A Familiar Failure Class
The incident is an application-layer entropy failure — a category that has produced several of the year's larger losses, including the Coldcard hardware wallet exploit, where a firmware change replaced the hardware random number generator with a predictable fallback, and the GoMining coordinated wallet drain, where roughly 600 addresses were swept for about $2.8 million.
The pattern is consistent across all three: the underlying chains and signing cryptography were never broken. What failed was the step that converts user-side randomness into private keys — a stage that sits outside consensus, outside audits of the ledger itself, and largely outside the assumptions users make when they pick a wallet.
XRP Healthcare's decision to shut down rather than rebuild is an unusually honest outcome for a project of its size, and it follows a small but visible 2026 trend of platforms choosing wind-down over relaunch after security failures. For users, the operative lesson is narrower and more practical: the provenance of a key matters as much as its custody, and credentials generated by compromised software stay compromised wherever they are imported.
TrustGrade covers the security and trust ecosystem around digital assets. For verified trust data on the platforms and firms shaping it, see trustgrade.ai.