XRP Healthcare Shuts Down After Wallet Bug Exposed ~4,000 Accounts and $450K Lost
The messy exit: drained wallets and a company bowing out
Short version: XRP Healthcare is winding down. A wallet flaw discovered in early September allowed an attacker to sweep thousands of accounts over a couple of days, moving roughly 267,664 XRP plus millions of XRPH and XRPHAI tokens — together worth about $450,000 — into a collector address. With that hit on top of development costs, a long crypto winter, and failed listing attempts, the team says it can no longer keep operating normally.
As part of the shutdown, the project is preparing to delist its tokens and the XRPH Wallet apps are offline. The company says it will keep its intellectual property and trademarks while working with exchanges and other parties to wind things down and preserve records tied to the incident.
How the bug happened and what users should do
The root cause was surprisingly boring for anyone who loves dramatic hacks: a credential-generation mistake. The wallet passed a 55-character string into xrpl.Wallet.fromEntropy(), which actually expects raw bytes. In practice only the first 16 characters mattered, leaving far fewer effective combinations than intended. In plain terms, the keyspace shrank from an expected 2^128 down to roughly 2^46, making it tractable to search.
To make matters worse, the code also used Math.random() for entropy, which further weakened the unpredictability. The devs were able to reproduce private keys for several live wallets — including a handful that had been emptied — using public data and a partial scan of the reduced keyspace. That means the compromise can be explained without any malware on users’ devices or a flaw in the XRPL itself.
If your credentials were generated by XRPH Wallet, don’t be cute about it: treat them as compromised. Importing the same seed into another wallet won’t fix the problem. The safe move is to abandon those credentials and move any remaining funds to fresh keys created with a properly implemented wallet.
The team says recovery and tracing efforts are ongoing. They tracked the stolen tokens through several moves and into an address on another chain where they were converted; a balance of stablecoins was reported there. Affected users were asked to document their drained transaction records to help tracing efforts and to cooperate with exchanges and investigators.
Bottom line: it’s an ugly reminder that crypto is unforgiving of sloppy key handling. If you used XRPH Wallet, assume those old keys are toast and move your funds to a wallet with verified entropy generation. And maybe keep a slightly unhealthy obsession with how your wallet generates randomness — it matters.
