XRP Healthcare (XRPH Wallet key generation) hack — September 2026

XRP Healthcare, a healthcare platform built on the XRP Ledger, lost about $450,000 of its users' funds when wallets created with its XRPH Wallet app were swept on 3 and 4 September 2026. XRPL.to traced 10,281 payments from 4,011 sender wallets over the two days and classified 4,010 of them as victims, after finding that one sender had funded the collector. About 267,664 XRP, 23.2 million XRPH and 2.43 million XRPHAI went to the collector, put at roughly $450,000 to $452,000.

The project's own developer investigation traced the drain to key generation. The app passed a 55-character value into xrpl.Wallet.fromEntropy(), which expects raw bytes, and only the first 16 characters were effectively retained, leaving 14 variable digits: about 72.9 trillion possible inputs, roughly 2^46, instead of the intended 2^128. The code also used Math.random(), which may have narrowed the search further. The team reproduced the private keys of nine live wallets, four of them among those drained, from public information and a partial scan of the reduced keyspace, and concluded that the defect explains the drain without any access to user devices or any flaw in the XRP Ledger. Because the weakness is in the keys themselves, importing the same seed into other software does not help, and users were told to abandon anything generated by XRPH Wallet.

The stolen assets left the XRP Ledger through NEAR Intents, crossed to Ethereum via Uniswap V4 and settled as about 445,198 DAI in one Ethereum address, which XRP Healthcare says it has traced end to end. On 10 September the company announced it was winding down, citing the incident alongside development costs, a prolonged bear market and an unsuccessful public-listing effort; XRPH and XRPHAI are being delisted and the wallet apps stay offline. It says recovery work will continue, but it has not offered compensation.