XRP Healthcare, a healthcare platform built on the XRP Ledger, is ceasing operations after a wallet security flaw led to significant financial losses and exposed thousands of user accounts.
On September 10, the company announced it would delist its tokens, XRPH and XRPHAI, with individual exchanges setting their own withdrawal deadlines. The XRPH Wallet applications will remain offline, though XRP Healthcare said it is retaining its intellectual property and trademark portfolio.
Scope of the Breach
Between September 3 and September 4, analytics service XRPL.to traced a mass sweep of 10,281 payments from 4,011 sender wallets. The service identified 4,010 wallets as victims after determining that one sender funded the collector account.
Approximately 267,664 XRP, 23.2 million XRPH, and 2.43 million XRPHAI were moved into a collector account, with the total value of stolen assets estimated at roughly $450,000 to $452,000.
Technical Vulnerability
XRP Healthcare's investigation traced the breach to a flaw in how XRPH Wallet generated credentials. The application passed a 55-character value into xrpl.Wallet.fromEntropy(), which expected raw bytes. Only the first 16 characters were retained, leaving 14 variable digits and reducing the possible input space to approximately 2^46 instead of the intended 2^128.
The developers also identified use of Math.random() in the wallet, which could have further reduced the practical search space. The team reproduced private keys for nine live wallets, including four confirmed drained accounts, using public information and a partial scan of the reduced keyspace.
XRP Healthcare advised affected users to abandon credentials generated through XRPH Wallet and move any remaining assets using newly created keys, noting that importing the same seed into different software would not secure an exposed wallet.
Contributing Factors and Recovery Efforts
The company cited the wallet incident as adding financial and operational pressure to a business already burdened by development costs, a prolonged crypto bear market, and an unsuccessful public-listing effort.
The stolen assets were traced to an Ethereum address holding approximately 445,198 DAI. XRP Healthcare asked affected users to submit reports on Etherscan using transaction records from their drained wallets and said it will continue working with exchanges, platforms, and authorities while preserving technical and transaction records related to the incident.
