XRP Healthcare Winds Down After Guessable Wallet Keys

XRP Healthcare is winding down after a wallet bug let an attacker rebuild user keys and drain about $452,000 from 4,010 accounts on September 3, 2026. The XRPH Wallet apps are offline, and XRPH and XRPHAI are being taken off exchanges.

The hole was not on the XRP Ledger. It sat in how the app made keys, a defect the company traced to June 13, 2023, and later reproduced on live accounts. Existing seeds cannot be repaired, which is why a software update was never going to save the product.

Fourteen Digits Behind Every XRPH Wallet

XRPH Wallet showed users eight six-digit padlock blocks, then joined that line of text and fed it to the XRP Ledger’s key function. That function is built for 16 bytes of random data, not a sentence of digits and spaces. The library kept the first 16 characters, two of them spaces that become zero, and threw the rest away.

Fourteen digits decided the wallet. Blocks D through H, 30 of the 48 digits on the padlock, never touched the key. The digits also came from Math.random(), which is not a cryptographic generator. XRP Healthcare’s developers said they rebuilt private keys for nine live wallets, including four confirmed drained accounts, from public information and a partial scan.

THE KEYSPACE THE APP ACTUALLY MADE

That reduced set is small enough to list on ordinary hardware and check against funded accounts on the ledger. Importing the same seed into other software does not help, because the weakness is in how the key was born, not in where it was later stored.

The investigation identified and reproduced a defect in the wallet-generation process where the app passed improperly formatted entropy into the XRPL key-generation function. This drastically reduced the effective keyspace and made offline reconstruction of private keys computationally feasible.

XRP Healthcare, root-cause findings, September 8, 2026

The company published that finding five days after the drain and kept the apps offline. The same store build, 8.0.15, had been on Google Play since July 28 and on the App Store since July 30, with 50,000+ Android installs listed.

The Sweep Ran Largest Balance First

On-chain analytics platform XRPL.to published an on-chain trace of the sweep from a full-history node. A collector address that did not exist an hour earlier, rGGXaBdSRUfdarKDkt2csxL67F8MEGxHVB, received 10,281 payments from 4,011 wallets. One of those wallets funded the collector with 15.4 XRP. The other 4,010 are the victims.

THE SEPTEMBER 3 AND 4 DRAIN

1. September 3, 2026, 21:36:32 UTC: The collector is funded with 15.4 XRP and opens trustlines.
2. 22:07:40 UTC: The first sweep takes 97,829 XRP from the largest wallet, leaving only the reserve.
3. 22:30 UTC: 242,536 XRP is already in, 90.6 percent of the stolen XRP, from the 738 richest wallets.
4. 22:38 to 00:20 UTC: Stolen XRPH is sold on XPMarket while empties continue. The token prints 0.000856 XRP at 00:50, down 91 percent.
5. September 4, 00:42:32 UTC: 307,000 XRP leaves for NEAR Intents and becomes 175.81 ETH.
6. 01:04:01 UTC: Another 4,614 XRP follows and becomes 2.65 ETH, 178.46 ETH in total.
7. 01:10:11 UTC: 178 ETH is swapped on Uniswap for 445,198 DAI, 3 hours 3 minutes after the first sweep.

The attacker took 267,664 XRP, 23.2 million XRPH from 2,024 wallets, and 2.43 million XRPHAI from 199 wallets. Fourteen XRPH swaps paid 42,057 XRP. Five XRPHAI offers paid 1,272 XRP. Forty-five emptied accounts were then deleted, which sent their last reserve to the collector as well.

Each victim signed an ordinary payment of its own balance. The ledger did what those keys authorized. Stolen value left through NEAR Intents, crossed to Ethereum, and settled in one Ethereum address holding the DAI. XRP Healthcare said that pile had not moved when it published the trail on September 6.

2,755 Drained Wallets Never Touched Staking

The first public theory was that staking had sent seeds to a company server. XRPL.to’s decompile found that path in the live build: stake, unstake and claim posted the seed as a field named secret. New stakes had stopped in July 2024, but unstaking and rollovers kept sending the seed until at least November 30, 2025. The company’s own staking wallet, whose key only the server holds, was emptied the same night.

That path does not explain the night. Of the 4,010 victim wallets, 1,199 (29.9 percent) had used staking and accounted for 148,397 XRP. 2,755 wallets (68.7 percent) never staked and still lost 119,256 XRP. Fifty-six wallets carried no app mark and lost a rounding remainder. XRPL.to checked every victim: 98.6 percent carried the app’s fingerprint, 95.5 percent were created in it, and none had used other wallet software.

HOW LARGE THE EMPTIED WALLETS WERE

Most victims were small. Two wallets held more than 10,000 XRP. Asked on September 5 whether seeds ever left the phone, XRP Healthcare first said XRPH is designed as a non-custodial wallet, with users retaining control of credentials and funds. Asked again the same day, it said it had not known that staking was less than fully non-custodial and was putting that to the developers who wrote the code.

The root-cause report named the key defect and said nothing about the seed being sent to a server. Those are two failures. The guessable keys are the one that reaches every wallet the app ever made.

A Code Change From June 2023

The XRPH Wallet launched in March 2023 as a healthcare-branded, non-custodial app on the XRP Ledger. XRP Healthcare later said it also ran a validator node. The defect the developers reproduced entered the wallet-generation path on June 13, 2023, and was still in the July 2026 store build.

That is more than three years of keys minted from a truncated string. Anyone who created an account in that window, staker or not, received a padlock that only looked like 48 digits. The company had already stopped new XRPH staking in 2024 during a supply squeeze, spent two years on a public listing that did not complete, and kept shipping the same generator.

On September 4 it told users not to use the app. On September 8 it posted the root-cause findings. On September 10 it said normal operations would wind down, citing a long bear market, listing costs, and the extra pressure from the incident. No bankruptcy filing, liquidation petition, or court process accompanied that note.

The same entropy class has already shown up elsewhere in 2026, including a Coldcard firmware flaw with losses put at more than $100 million. Those events are separate products. They share the same cheap lesson: if the generator is weak, the chain can be honest and the coins still leave.

What XRPH Holders Should Do With Old Seeds

Anyone who ever generated keys inside XRPH Wallet should treat that seed as permanently compromised, even if the account was not among the 4,010 emptied on September 3. A later import into a different app reuses the same weak key. Remaining on-chain balances have to move with newly created keys in software that never saw the old padlock.

WHAT TO DO BEFORE EXCHANGE WINDOWS CLOSE

• Old seeds: Abandon every phrase or padlock created in XRPH Wallet and do not type it into a new app.
• Leftover balances: Create a fresh wallet in unrelated software, then send any remaining XRP or tokens to that new address.
• Exchange balances: Read the delist notice at the venue that still holds XRPH or XRPHAI; each desk sets its own cutoff.
• Records: Keep transaction hashes from drained wallets. The company has asked affected users to file factual reports on Etherscan.
• Inbound DMs: Ignore anyone offering a recovery portal, a seed checker, or a guaranteed refund.

Taking the app offline does not delete XRPL accounts. Balances and history remain visible on the ledger, which is why a new key can still sweep what the attacker missed. It is also why a stranger with a copy of the generator can keep hunting the same keyspace.

Bitrue Leaves Withdrawals Open Until December

XRP Healthcare said orderly delistings of XRPH and XRPHAI are being coordinated with exchange partners, and that holders must follow each venue’s own notice. Bitrue posted its notice on September 10. Deposits are closed, XRPH/USDT spot trading is closed, and withdrawals open until December 10, 2026. After that date it will drop support, and leftover tokens become unrecoverable on that platform.

The company’s site now states that digital services are temporarily unavailable while security and recovery work continues, with updates promised on official X and Telegram channels. Recovery, in that wording, sits beside the wind-down rather than reversing it.

XRP HEALTHCARE — OPERATIONAL WIND-DOWN

After nearly three years of building XRP Healthcare, we have made the difficult decision to begin winding down the company’s normal operations.

This decision has not been taken lightly.

Over the past three years, we have continued…

— XRP Healthcare (@XRPHealthcare) September 10, 2026

Intellectual Property Stays With the Company

The September 10 statement said XRP Healthcare’s intellectual property and global trademark portfolio will be retained and managed separately from the operational wind-down. Users keep the drained balances and the burned seeds. The LLC keeps the brand.

On September 11, answering claims that the firm had taken the money, the company said there has been no finding of wrongdoing and no evidence it took the stolen funds. It also closed the door on a make-whole pledge.

We will continue doing everything reasonably possible to recover them, but we will not make reimbursement promises we cannot guarantee.

XRP Healthcare, September 11, 2026

The 445,198 DAI was still sitting in one Ethereum address when the company last published the trace. Holders with coins on Bitrue have until December 10, 2026 to withdraw. Everyone who ever made a key in XRPH Wallet still has a padlock that only looks like it has 48 digits.

Disclaimer: This article is news reporting on a completed theft, a published technical finding, and an announced operational wind-down. It is informational only and is not investment advice, legal advice, tax advice, or a recommendation to buy, sell, hold, or transfer any token, including XRP, XRPH, or XRPHAI. Readers who still hold those assets or who used XRPH Wallet should consult a qualified cryptocurrency-security professional and, where funds were stolen, independent legal counsel before moving remaining balances or filing claims. Figures, addresses, delisting dates, and recovery status reflect the company statements, exchange notice, and on-chain analysis cited here and may change as exchanges set further deadlines or as frozen funds are updated.