XRP Healthcare has taken XRPH Wallet offline. On-chain analysis shows that this incident affected 4,011 wallets within about 3 hours, involving 267,664 XRP, as well as a large number of XRPH and XRPHAI tokens. The current information indicates that the problem is more likely to lie in the wallet application layer, rather than the XRP Ledger protocol itself.
Funds are first pooled before being transferred across chains.
According to XRPL data platform XRPL.to, the attack occurred in the late evening of September 3rd. A newly created address gradually received the balances from 4,011 wallets, with larger accounts being emptied first. By 22:30 UTC, this collecting address held over 242,000 XRP.
Subsequently, these funds were transferred further. XRPL.to traced them to 311,613 XRP. These were then processed across chains via NEAR Intents and first converted into approximately 178.46 ETH. Finally, they were converted into 445,198 DAI on Ethereum. At the time of the forensic report release, this batch of DAI was still held in a single address.
According to the estimation of XRP Healthcare, the total value of the stolen assets is approximately $452,000. In addition to XRP, the affected wallets also lost about 23.2 million XRPH and 2.43 million XRPHAI.
The way private keys are handled is under question.
The reason this incident has drawn attention is that the focus of the attack seems to be on the wallet software itself. XRPL.to indicates that XRPH app used to save the wallet seed in an unencrypted form on the phone, and its staking function would also send users' seed information to XRP Healthcare's servers.
Among the 1,225 wallets that have used the staking function, 1,198 have been emptied. However, about 70% of the victims had not used the staking function before, which suggests that the risk may not come solely from this feature; the overall way these wallets handle their keys is also under question.
XRP Healthcare has currently disabled access to XRPH Wallet for the purpose of investigating the incident. The application being taken offline does not mean that the XRPL account will disappear; users can still view their balances and historical transactions directly on the blockchain.
XRP Recent increase in ecological alerts
There is currently no indication that the XRP Ledger protocol layer or validator keys have been compromised. The article mentions that recently, there were also vulnerability incidents on the Coreum and XRPL cross-chain bridges, during which approximately 200,000 XRP were transferred due to relay logic defects, but the XRPL validator keys were not compromised.
Meanwhile, holders of XRP have also recently received multiple security alerts. XRP Ledger Foundation has previously warned users to be cautious of counterfeit XRP reward campaigns, which are typically aimed at stealing wallet credentials. As more XRP users switch from exchanges to self-hosting, the importance of private key isolation and local security management is also increasing.
