wallet vulnerability

A healthcare platform built on XRP Ledger is shutting down after a critical wallet vulnerability drained approximately $450,000 from thousands of user accounts. The incident underscores persistent security risks in decentralized applications and highlights challenges facing blockchain startups even as recovery and investigation efforts continue.

• XRPH Wallet flaw exposed 4,010 user accounts and resulted in roughly $450,000 in stolen assets between September 3 and 4.
• The vulnerability reduced the cryptographic keyspace from the intended 2^128 to approximately 2^46, enabling attackers to derive private keys from public information.
• XRP Healthcare will delist tokens and cease operations while pursuing recovery efforts and coordinating with exchanges, platforms, and authorities.

• $450,000 Value of stolen assets moved to collector account during the breach
• 4,010 User wallets classified as victims after the mass sweep attack
• 2^46 Effective cryptographic keyspace after bug versus intended 2^128
• Sept. 3 Date the XRPH Wallet incident occurred and funds were drained

XRP Healthcare announced its operational shutdown on September 10, citing the wallet vulnerability alongside existing pressures including prolonged market downturn, elevated development costs, and a failed public-listing attempt. The platform disclosed that a flaw in how its XRPH Wallet application generated user credentials had enabled attackers to systematically drain accounts over a 48-hour window. Analytics service XRPL.to traced 10,281 payments across this period, originating from what the company determined to be 4,010 compromised wallets sending funds to a single collector address.

The incident represents one of the most significant security failures within the XRP Ledger ecosystem and demonstrates how implementation errors in cryptocurrency wallet design can rapidly compromise user funds at scale. Even as blockchain technology matures, wallet security remains a critical vulnerability, particularly for platforms that manage both crypto assets and sensitive personal health information.

How The Wallet Flaw Collapsed Cryptographic Security

XRP Healthcare’s investigation identified the root cause: the application passed a 55-character string into xrpl.Wallet.fromEntropy(), a function designed to accept raw bytes as input. Only the first 16 characters were retained by the system, leaving 39 characters unused and drastically reducing the effective entropy to approximately 72.9 trillion possible combinations, or roughly 2^46, versus the intended 2^128 security level.

The developers also discovered that the wallet generation process relied on Math.random(), a function known to have limited cryptographic strength compared to secure random number generators, potentially reducing the practical search space further. Using only public information and a partial scan of the reduced keyspace, the team successfully reproduced private keys for nine live wallets, including four that had already been drained. This reproduction required no access to user devices or the underlying XRP Ledger protocol itself.

The flaw meant that users could not protect exposed wallets simply by importing the same seed phrase into different software applications.

The vulnerability illustrates a common pitfall in blockchain development: cryptographic security requires precision at every step of key generation and storage. Small oversights in how entropy is passed between functions or how random number generators are selected can cascade into catastrophic failures affecting thousands of users. Security audits and code reviews by external specialists are increasingly viewed as essential for platforms handling user assets.

Stolen Assets Traced To Ethereum Address

The attack resulted in the movement of approximately 267,664 XRP, 23.2 million XRPH tokens, and 2.43 million XRPHAI tokens to the identified collector wallet. XRP Healthcare traced the stolen assets end-to-end to an Ethereum address holding roughly 445,198 DAI, providing a clear on-chain record of the funds’ destination.

The cross-chain movement of funds reflects how attackers often bridge stolen assets across multiple blockchains to obscure the trail and access liquidity on different platforms. Despite the transparency of blockchain ledgers, tracing and recovering funds remains challenging without cooperation from centralized exchange operators and law enforcement agencies equipped to handle cryptocurrency theft investigations.

The company has advised all affected users to abandon any credentials generated through XRPH Wallet and transfer remaining assets using newly created keys generated through secure methods. XRP Healthcare requested that affected users submit detailed factual reports on Etherscan, including transaction records documenting their drained wallets, to support ongoing recovery and investigation efforts.

Platform Delisting And Continued Coordination

XRP Healthcare announced plans to delist its native tokens, XRPH and XRPHAI, from exchanges, with individual platforms expected to establish their own withdrawal deadlines. The XRPH Wallet applications will remain offline, though the company stated it is retaining its intellectual property and global trademark portfolio.

The decision to retain intellectual property suggests the possibility that XRP Healthcare’s technology, once remediated, could be acquired or rebuilt under new ownership. However, the reputational damage from a major security breach typically makes it difficult for platforms to rebuild user trust, even with improved security measures.

Despite ceasing normal operations, the company said recovery efforts will continue in parallel with its wind-down. XRP Healthcare committed to ongoing coordination with exchanges, platforms, law enforcement authorities, and other parties while preserving all technical records and transaction documentation related to the incident.

The company has preserved technical and transaction records connected to the incident and will continue working with law enforcement and platform operators; affected users should monitor their email and official XRP Healthcare channels for exchange-specific withdrawal deadlines and recovery procedures.