XRP Healthcare reports $452,000 stolen from 4,011 wallets in unauthorized transactions

XRP Healthcare is investigating a security breach beginning September 3, 2026, that drained approximately $452,000 from 4,011 XRPH wallets. On-chain analysis traced the stolen 267,664 XRP and 23.2 million XRPH tokens to an Ethereum address holding 445,198 DAI. While forensics by XRPL.to suggest a staking-related code path leaked users' seed phrases to a remote server, XRP Healthcare claims management was unaware of this transmission and is demanding answers from its developers. The incident has reignited criticisms from former Ripple developers who previously flagged the project.

XRPH Wallet unauthorized transactions

• ▪XRP Healthcare instructed users to stop using the XRPH Wallet until further notice while its development team investigated the September 2026 compromise.
• ▪XRP Healthcare reported that approximately 4,011 XRPH Wallet accounts were affected by unauthorized transactions beginning September 3, 2026.
• ▪XRP Healthcare stated that its investigation found no evidence indicating the underlying XRP Ledger protocol itself was responsible for the September 2026 security breach.
• ▪The unauthorized transactions involving XRP Healthcare's wallets resulted in the removal of approximately $452,000 in XRP, XRPH, XRPHAI, and other digital assets.

Seed phrase staking vulnerability

• ▪XRP Healthcare stated that its management believed the XRPH Wallet was non-custodial and was unaware that the staking flow transmitted seed phrases to the backend until the XRPL.to decompilation was published.
• ▪Forensic analysis by XRPL.to alleged that decompiling XRPH Wallet Android build 8.0.15 revealed a staking-related code path that transmitted users' seed phrases to a remote server.
• ▪XRP Healthcare demanded a full documented explanation from the developers who built the XRPH Wallet regarding the seed-exposing staking path.
• ▪Independent investigators noted that some drained XRPH wallets had no staking history, meaning the staking-related seed phrase exposure does not yet explain all unauthorized transactions.

On-chain fund tracing

• ▪On-chain analysis by researcher Handy Andy and XRPL.to showed that the affected XRPH wallets lost 267,664 XRP and approximately 23.2 million XRPH tokens.
• ▪The stolen assets from the XRPH Wallet breach were routed from the XRP Ledger through NEAR Intents to Ethereum, where they were converted into approximately 445,198 DAI.
• ▪XRP Healthcare contacted exchanges and other platforms along the transaction path to flag the destination Ethereum address and attempt to freeze or recover the stolen funds.
• ▪The converted stolen assets from the XRPH Wallet breach remained in the destination Ethereum address 0x3DC7BFf29Fc5a051aAB250516BaBD74ae7068930 as of September 6, 2026.

Former Ripple developer warnings

• ▪Former Ripple developer-growth staffer BiasGoose stated he previously rejected a grant application from XRP Healthcare due to obvious red flags and alleged misrepresented partnerships.
• ▪XRP Healthcare rejected the criticisms from former Ripple developers, accusing them of celebrating another team's losses and calling their conduct 'genuinely pathetic.'
• ▪Former Ripple developers Hazard Cookie and Matt Hamilton reiterated prior concerns about XRP Healthcare, with Matt Hamilton stating the project was 'all red flags' when he spoke to them.

Wallet migration security guidance

• ▪As of September 7, 2026, XRP Healthcare had not announced a reimbursement program, recovery deadline, or confirmed whether law enforcement or exchanges successfully froze the stolen funds.
• ▪Security guidance indicates that users who imported seed phrases into the compromised XRPH Wallet must transfer remaining funds to newly generated wallets rather than relying on app updates.