XRP Healthcare Takes XRPH Wallet Offline After Security Breach Affects 4,011 Users
XRP Healthcare has taken its XRPH Wallet application offline after a security breach affected 4,011 user wallets and resulted in approximately $452,000 in assets being transferred without authorization.
The company said the decision to disable the application was a precaution while it investigates the incident. Although users cannot currently access their accounts through the XRPH Wallet application, the underlying wallets remain active as separate accounts on the XRP Ledger.
Users who have their XRP Ledger addresses can still check wallet balances and transaction histories through blockchain explorers. XRP Healthcare has also advised users not to use the wallet application while the investigation continues.
Preliminary findings have not identified a failure in the XRP Ledger itself or a compromise of the network’s security. Instead, investigators are examining how private credentials associated with affected wallets may have been exposed.
XRPH Wallet Breach Sends Assets Through NEAR Intents
Blockchain data reviewed by XRP Ledger analytics platform xrpl.to indicates that the unauthorized transfers took place over a three-hour period on September 3.
A newly created address reportedly received assets from the 4,011 affected wallets. The transfers included 267,664 XRP, 23.2 million XRPH tokens and 2.43 million XRPHAI tokens.
A further 311,613 XRP was transferred into NEAR Intents, according to the analytics platform.
The assets subsequently appeared on Ethereum in the form of 178.46 ETH. The ETH arrived within one minute of each deposit before being converted into 445,198 DAI in one identified address.
At the time investigators published their findings, the identified DAI had not moved. That left the funds traceable through publicly available blockchain transaction records.
The movement of assets across different blockchain networks is now part of the transaction trail being examined as investigators work to determine how the unauthorized transfers occurred.
Private-Key Handling Under Scrutiny
The investigation is also examining the XRPH Wallet’s methods for handling private credentials.
According to xrpl.to, the wallet application signed payments directly on users’ phones and stored seed phrases without encryption. The platform also reported that the wallet’s staking feature transmitted seed phrases to an XRP Healthcare server.
Records cited by xrpl.to show that 1,225 wallets used the staking service, primarily between December 2023 and July 2024. Of those, 1,198 staking wallets, along with XRP Healthcare’s staking wallet, were reportedly drained during the incident.
The findings have raised questions about whether the staking mechanism was connected to the exposure of private credentials.
However, the affected wallets were not limited to users who had participated in staking. Approximately 70% of the wallets affected by the incident had never used the staking service.
That distribution has broadened the scope of the security review, as it suggests the exposure may involve the wallet application’s wider approach to private-key and seed-phrase management rather than the staking feature alone.
XRP Healthcare Investigation Remains Ongoing
XRP Healthcare has not confirmed the specific method through which the private credentials may have been exposed. The company said additional technical evidence is needed before investigators can establish how the breach occurred.
For the time being, the XRPH Wallet application remains unavailable while the security assessment continues.
The distinction between the wallet application and the XRP Ledger is also significant in the company’s response. While access through the application has been suspended, the affected wallets themselves continue to exist as separate XRP Ledger accounts, allowing their addresses and onchain activity to remain visible through blockchain records.
The investigation will need to determine how credentials associated with the affected accounts were obtained and whether the reported exposure originated from a particular wallet function or a broader aspect of the application’s security architecture. According to XRP Healthcare.
Writer: Marcus RenfieldCrypto Market Analyst & Onchain WriterMarcus Renfield covers cryptocurrency markets with a focus on onchain data, Bitcoin price action, and emerging market narratives. His writing examines how capital flows, network activity, and broader market structure influence short- and medium-term trends.He aims to provide clear, data-informed analysis for readers seeking a deeper understanding of crypto market dynamics.