XRP Healthcare, a platform specializing in AI healthcare solutions on the XRP Ledger, has taken its XRPH Wallet app offline following a security breach that affected thousands of users and resulted in significant asset losses.
Security incident details
The company confirmed that its own team removed the XRPH Wallet apps as a precautionary response to the incident, clarifying that the action was not initiated by any external attacker. XRP Healthcare emphasized that users can still verify their wallet balances and transaction history directly on-chain through their XRPL addresses, even though access via the XRPH Wallet app remains suspended while the investigation continues.
In a security update issued on September 4, XRP Healthcare reported a series of unauthorized transactions impacting users. The company advised wallet holders to refrain from using the XRPH wallet until further notice.
XRP Healthcare stated that the breach affected a total of 4,011 wallets, with approximately $452,000 in digital assets stolen. The stolen funds were traced to a single Ethereum wallet, which now holds around 445,000 DAI tokens. As of the latest update, these funds have not moved since the incident occurred.
On-chain movements and preliminary findings
According to analytics platform xrpl.to, the breach unfolded rapidly over a three-hour period on September 3, 2026. The attacker’s wallet, created only an hour before the theft, received the full balance of the 4,011 affected wallets. Assets included 267,664 XRP, 23.2 million XRPH, and 2.43 million XRPHAI. Of these funds, 311,613 XRP was processed through NEAR Intents, converted to 178.46 ETH on Ethereum within minutes, and ultimately swapped into 445,198 DAI, all centralized in a single address that remains untouched.
XRPH Healthcare’s preliminary investigation found no evidence of any fault or vulnerability on the XRP Ledger itself. However, the root cause of the wallet key compromise is still under review, and further verification is required before determining how access was gained.
Xrpl.to provided additional insight into the technical aspects behind the breach, indicating that the XRPH Wallet app signs payments on the mobile device itself while the seed phrase is stored in an unencrypted format. Furthermore, the app’s staking feature transmits the seed phrase to XRP Healthcare’s server for processing.
User exposure and potential causes
The data revealed that 1,225 wallets participated in staking, almost all between December 2023 and July 2024. Among these, 1,198 staking wallets were emptied, as was the main staking wallet controlled solely by XRP Healthcare’s servers. However, most victims had never used the staking feature. Xrpl.to suggested that the vulnerability may have exposed the entire base of XRPH app users, rather than being confined to those participating in staking.
While investigating the methods used in the breach, the company continues to urge patrons to avoid accessing the XRPH Wallet until comprehensive security measures can be restored and user safety assured.
In light of this breach and wider trends in digital asset security, new methods for safeguarding and managing tokenized financial instruments have gained traction. While traditional markets rely on complex brokers, a massive shift is happening: Wall Street is moving to Web3. Investors are now using platforms like 1stepSwap to hold shares of major U.S. companies, gold, and silver directly in their crypto wallets. By tokenizing Real-World Assets (RWAs) and automatically finding the best market prices in seconds, it completely removes the middlemen.
