XRP Healthcare reports $452,000 stolen from 4,011 wallets in unauthorized transactions

Sep 7, 2026

XRP Healthcare is investigating a major security breach after unauthorized transactions beginning September 3, 2026, drained approximately $452,000 from 4,011 XRPH Wallets. On-chain analysis shows the stolen assets were converted into 445,198 DAI on Ethereum. Independent researchers attribute the compromise to a staking-related code path that leaked user seed phrases to a remote server, prompting XRP Healthcare to demand answers from its wallet developers. Meanwhile, former Ripple developers have revived past warnings about the project, which XRP Healthcare has publicly disputed.

XRPH Wallet breach investigation

▪XRP Healthcare instructed users to stop using the XRPH Wallet while its development team investigated the unauthorized transactions.
▪XRP Healthcare reported that approximately 4,011 XRPH Wallet accounts were affected by unauthorized transactions beginning September 3, 2026, resulting in an estimated loss of $452,000.
▪XRP Healthcare stated that its investigation found no evidence that the underlying XRP Ledger protocol itself was responsible for the wallet breach.

Seed phrase exposure via staking

▪XRP Healthcare demanded a full documented explanation from the developers who built the XRPH Wallet regarding the unauthorized transmission of seed phrases.
▪An analysis by XRPL.to alleged that decompiling XRPH Wallet Android build 8.0.15 revealed a staking-related code path that transmitted user seed phrases to a remote server.
▪XRP Healthcare stated that management believed the XRPH Wallet was non-custodial and was unaware that the staking flow transmitted seed phrases to the backend until learning of the XRPL.to decompilation.

On-chain fund tracing

▪Independent ledger reviews and XRPL.to reported that the compromised XRPH Wallets lost approximately 267,664 XRP and 23.2 million XRPH tokens before being converted.
▪The converted stolen funds remained in the Ethereum destination address 0x3DC7BFf29Fc5a051aAB250516BaBD74ae7068930 as of September 6, 2026.
▪On-chain investigators traced the stolen assets through NEAR Intents and Ethereum, where they were swapped via Uniswap V4 into approximately 445,198 DAI.

Former Ripple developer warnings

▪Former Ripple director of developer relations Matt Hamilton stated that the XRP Healthcare project, previously known as XRPayNet, presented numerous red flags during prior discussions.
▪Former Ripple developer-growth staffer BiasGoose stated he previously rejected an XRP Healthcare grant application due to what he characterized as obvious red flags and misrepresented partnerships.
▪XRP Healthcare publicly rejected the criticisms from former Ripple developers, calling their social media conduct genuinely pathetic and accusing them of celebrating another team's losses.

User wallet migration guidance

▪As of September 7, 2026, XRP Healthcare had not announced a user reimbursement program, a recovery timeline, or confirmation that any exchange had successfully frozen the stolen DAI.
▪Security analysts advised affected XRPH Wallet users that they must transfer remaining funds to newly generated wallets with new seed phrases, as simply updating the application will not revoke attacker access to compromised seeds.

Debatable claims

▪XRP Healthcare management is responsible for the wallet's security failures
▪Developers should publicly criticize compromised crypto projects during security crises
▪XRP Healthcare should reimburse users affected by the wallet breach