XRP Healthcare Winds Down After Roughly $450K Wallet Theft

XRP Healthcare is winding down after an XRP Healthcare wallet flaw led to roughly $450,000 being drained from about 4,010 wallets, according to a developer incident report and attributed reporting. The project has confirmed its digital services are temporarily unavailable while security and recovery work continues.

XRP Healthcare Winds Down Following Wallet Flaw

XRP Healthcare’s official website states that its digital services are temporarily unavailable while the team completes security and recovery work following the XRPH Wallet incident. The notice confirms a suspension, not a completed shutdown. For related coverage, see Sunrise Lists Healthcare Stocks as Solana Tokenized Equity Market Hits $465M.

CryptoSlate reported that the company announced an operational wind-down on September 10, 2026, citing the wallet incident alongside development costs, a prolonged bear market and an unsuccessful public-listing effort. The reporting frames the flaw as one factor, not the sole cause. For related coverage, see Flávio Bolsonaro overtakes Lula on Polymarket.

The wind-down includes planned delistings of XRPH and XRPHAI, exchange-specific withdrawal deadlines, continued suspension of the wallet app and ongoing recovery efforts, per CryptoSlate. This is a project-level event and does not implicate Ripple, the broader XRP Ledger, or unrelated XRP services. Other firms have paused products before, as when Bitwise shut down its Dogecoin ETF within a year of launch.

What the reported wind-down means

At drafting time, the official homepage confirms only a temporary suspension of digital services. The permanent wind-down is supported by attributed reporting rather than a directly fetched company statement, so the distinction between winding down and having already ceased all operations should be preserved.

Roughly $450,000 Stolen From About 4,010 Wallets

The developer report dates the incident to September 3, 2026 and the report itself to September 7, 2026, estimating that approximately $450,000 was moved, according to the developer findings. That figure is the developer’s loss estimate, not an independently recomputed valuation.

Reported losses and affected wallets

CryptoSlate, citing XRPL.to analytics, attributes 10,281 payments from 4,011 sender wallets on September 3 and 4 to a collector. XRPL.to classified 4,010 of those as victims after excluding one sender that funded the collector, which explains the gap between the developer report’s 4,011-drained count and the 4,010-victim figure. These remain attributable secondary totals, not independently checked ledger evidence, and 4,010 is a wallet count rather than a verified count of individual users.

What is established about the wallet flaw

The developer report says a 55-character string was passed into xrpl.Wallet.fromEntropy(), which expected bytes; truncation retained 16 characters, including two fixed spaces, leaving 14 variable digits. The report gives the resulting keyspace as 72,899,838,000,090 combinations, roughly 2^46.05, against an intended 2^128.

The team says it regenerated nine live wallets, including four confirmed drained victims, during a partial scan of about 35 billion candidate inputs. It traces the defect to commit f1884a6 on June 13, 2023, dates the public source release to September 10, 2023, and says the flaw remained in the July 28, 2026 pre-incident commit.

This is a developer-authored report, not an independent or third-party audit. — XRP Healthcare development team

The report concludes that all wallets generated by the application must be treated as compromised and that users require newly generated keys. It attributes the failure to application key generation and states the XRP Ledger itself was not compromised. According to an unconfirmed company claim relayed by CryptoSlate, stolen assets were traced to an Ethereum address holding about 445,198 DAI; the underlying transaction trail was not independently verified. Concerns over wallet-layer security have surfaced elsewhere, from a hacker bounty demand in the Liquid network exploit to MetaMask’s planned separation from Consensys.

Unresolved Questions for Affected Wallet Holders

The available evidence does not establish whether reimbursements will be offered, how much of the moved value can be recovered, or how holders can access any remaining funds. A precise shutdown schedule and verified holder instructions are also not confirmed in the current materials.

These are gaps in the fetched evidence, not proof that the project has stayed silent; the company has issued public statements and its site confirms recovery work is underway. Affected holders should watch for the specific exchange withdrawal deadlines and delisting dates that CryptoSlate says accompany the wind-down.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.