XRP Healthcare

Rocket

<p class="is-style-lead">XRP Healthcare said 4,011 XRPH Wallet accounts were affected by unauthorized transactions beginning Sept. 3, with approximately $452,000 in XRP and related assets removed.</p><div id="cn-block-summary-block_dda86b389741cd5d2a7db6d5fbb0be5c" class="cn-block-summary"><div class="cn-block-summary__nav tabs"><span class="tabs__item is-selected">Summary</span></div><div class="cn-block-summary__content"><ul class="wp-block-list"><li>XRP Healthcare said 4,011 wallets lost approximately $452,000 during unauthorized transactions beginning September 3, 2026.</li><li>The project traced stolen assets to one Ethereum wallet and contacted exchanges about freezing funds.</li><li>Users were told to stop using XRPH Wallet while the development team investigated the breach.</li><li>Independent investigators attributed the compromise to seed phrases transmitted through a staking-related server request process.</li><li>Former Ripple developers said earlier grant reviews identified project risks, allegations XRP Healthcare publicly disputed.</li></ul></div></div><p>You might also like: <a href="https://crypto.news/xrp-healthcare-launches-xrphai-token-trading-on-mexc/" rel="noopener noreferrer nofollow"> XRP Healthcare launches XRPHAI token trading on MEXC </a></p><h2 class="wp-block-heading" id="strong-xrp-healthcare-traces-stolen-funds-to-ethereum-strong"><strong>XRP Healthcare traces stolen funds to Ethereum</strong></h2><p>XRP Healthcare initially <a href="https://x.com/XRPHealthcare/status/2095769480726991166?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">confirmed</a> unauthorized transactions involving XRP, XRPH, XRPHAI and other assets. The company instructed users to stop using XRPH Wallet until further notice while its developers investigated the compromise.</p><p>A subsequent <a href="https://x.com/XRPHealthcare/status/2095869911700533721?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">update</a> placed the affected wallet count at approximately 4,011 and the estimated loss at $452,000. The company said investigators traced the assets to one Ethereum address and contacted exchanges and other parties about freezing or recovering them.</p><p>Independent on-chain researcher Handy Andy <a href="https://x.com/Handy_4ndy/status/2096334735605731760?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">reported</a> that the affected accounts lost 267,664 XRP and approximately 23.2 million XRPH tokens. The researcher said the assets were converted into roughly 445,198 DAI on Ethereum and remained in the destination wallet at the time of the update.</p><h2 class="wp-block-heading" id="strong-investigators-examine-a-possible-seed-phrase-leak-strong"><strong>Investigators examine a possible seed phrase leak</strong></h2><p>Independent investigators attributed the XRPH Wallet breach to its staking function. Their analysis alleged that activating staking caused users’ seed phrases to be transmitted to a remote server.</p><p>XRP Healthcare had not published source code, server logs or an independent forensic report confirming that explanation when this article was prepared. The seed phrase exposure therefore remains a researcher finding rather than a company-confirmed root cause.</p><p>A seed phrase provides control over every private key generated by a wallet. Anyone obtaining it can reproduce the wallet and authorize transactions without accessing the victim’s phone. Crypto.news previously explained how <a href="https://crypto.news/what-is-a-crypto-wallet-hot-vs-cold-seed-phrases-and-how-to-choose/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">seed phrases function as master recovery keys</a> and why they should never leave the user’s secure environment.</p><p>The reported failure resembles a July incident in which a <a href="https://crypto.news/compromised-injective-sdk-sends-wallet-keys-through-fake-telemetry/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">compromised software package transmitted private keys</a> through a fraudulent telemetry function. However, no evidence currently connects the two cases or their perpetrators.</p><h2 class="wp-block-heading" id="strong-former-ripple-developers-revive-earlier-concerns-strong"><strong>Former Ripple developers revive earlier concerns</strong></h2><p>The breach prompted public criticism from developers previously associated with Ripple and the XRP Ledger ecosystem. BiasGoose <a href="https://x.com/BiasGoose/status/2096578567647658155" rel="noopener noreferrer nofollow">said</a> he had rejected an earlier grant application from the project because the application showed what he considered clear warning signs.</p><p>He later <a href="https://x.com/BiasGoose/status/2096594818449187003" rel="noopener noreferrer nofollow">alleged</a> that the team had misrepresented partnerships in its application. Hazard Cookie <a href="https://x.com/hazardcookie/status/2096588648623816948" rel="noopener noreferrer nofollow">said</a> earlier reviewers had identified risks that were not publicly visible at the time.</p><p>Former Ripple developer Matt Hamilton also <a href="https://x.com/HammerToe/status/2096608309226684748" rel="noopener noreferrer nofollow">referred</a> to the project’s earlier reputation within the community. These statements represent the developers’ accounts. Public grant records or complete audit documents substantiating every allegation were not available.</p><figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper"><blockquote class="twitter-tweet"><p>Yup was all red flags when I spoke to them before as XRPayNet.</p>— Matt Hamilton (@HammerToe) <a rel="noopener noreferrer nofollow" href="https://x.com/HammerToe/status/2096608309226684748?ref_src=twsrc%5Etfw">September 6, 2026</a></blockquote></div></figure><p>XRP Healthcare rejected the tone of the criticism and accused former developers of celebrating another team’s losses. Its <a href="https://x.com/XRPHealthcare/status/2096602717590339820" rel="noopener noreferrer nofollow">response</a> called that conduct “genuinely pathetic” and said the company had put its own reputation and capital at risk. The exchange did not resolve the technical questions surrounding the wallet.</p><h2 class="wp-block-heading" id="strong-users-need-new-wallets-before-moving-remaining-assets-strong"><strong>Users need new wallets before moving remaining assets</strong></h2><p>XRP Healthcare must now establish the precise entry point, determine when seed information may have been exposed and identify which application versions were affected. A full postmortem should also explain whether the reported server retained seed phrases and who could access them.</p><p>Users who created or imported seed phrases into the affected application cannot rely solely on an app update if those phrases were exposed. Remaining funds should be transferred to newly generated wallets using trusted software. Reusing an old seed would preserve the attacker’s access.</p><p>The company has not announced a reimbursement program or recovery deadline. It also has not confirmed whether law enforcement or any exchange successfully froze the traced funds. Users should rely on official channels and reject unsolicited recovery offers requesting keys, seed phrases or payments.</p><p>The incident follows a wider rise in wallet and infrastructure compromises. As crypto.news reported, <a href="https://crypto.news/crypto-security-losses-hit-1-1b-in-h1-2026-blockaid-report/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">operational security failures caused 74% of stolen funds</a> during the first half of 2026. Separately, Ripple’s recent audit program <a href="https://crypto.news/ripple-sherlock-audit-96-bugs-before-single-wallet/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">identified 96 vulnerabilities across proposed XRPL amendments</a>, showing the value of testing before software reaches users.</p><p>Read more: <a href="https://crypto.news/rocket-suffers-287k-loss-after-attacker-manipulates-dormant-perp-market/" rel="noopener noreferrer nofollow"> Rocket suffers $287K loss after attacker manipulates dormant perp market </a></p>

XRP Healthcare says 4,011 wallets lost $452,000

Table of Contents

crypto.news

Other articles published on Sep 7, 2026

Missed SHIB’s Biggest Moves? Apeing’s $0.0001 Stage 1 Has 48 Hours Left Before a Next 1000x Meme ...

Near Protocol Moves Closer To Its $70M Reward Snapshot

Vitalik Bets Against AI Breaking Bitcoin Security

Ethereum (ETH) Price: What $2,381 and $2,515 Mean for the Next Move

Sen. Lummis Warns CLARITY Act Delay Could Push Vote To 2030

Vitalik Buterin Sees Strong Odds For Major Cryptography Breakthrough

Join our free newsletter for daily crypto updates!