A major security breach involving the XRP Healthcare wallet has resulted in the loss of approximately 267,664 XRP and millions of XRPH tokens from thousands of users.
Crypto Banter reported that attackers emptied 4,011 app wallets within roughly three hours on September 3, with the stolen assets later converted into about 445,198 DAI on Ethereum. The scale and speed of the incident have raised serious questions about the wallet application’s security and its staking functionality.
Attack Drained Thousands of Wallets
According to the report shared by Crypto Banter on X, the attackers targeted users of the XRP Healthcare mobile wallet, removing approximately 267,664 XRP alongside millions of XRPH tokens. Independent on-chain analysis from XRPL.to also identified about 23.2 million XRPH among the stolen assets. The analysis found that the affected wallets were emptied in a coordinated operation lasting approximately three hours.
XRP Healthcare has confirmed that approximately 4,011 wallets were affected by unauthorized transactions. The company has valued the assets taken at roughly $452,000 and instructed users to stop using the XRPH Wallet while the investigation continues.
The incident did not involve a compromise of the XRP Ledger itself. Available reporting points toward the wallet application and its associated infrastructure rather than the underlying blockchain protocol.
🚨XRP HEALTHCARE WALLET HACK EMPTIES 4,011 ACCOUNTS!
Attackers drained about 267,664 ripple:native from @XRPHealthcare’s mobile wallet on Sept. 3, plus millions of $XRPH.
The sweep hit 4,011 app wallets in about three hours. The haul was then bridged through NEAR Intents and… pic.twitter.com/h3fVOx6cX1
— Crypto Banter (@crypto_banter) September 7, 2026
Stolen Funds Moved to Ethereum
Crypto Banter also reported that the stolen assets were moved through NEAR Intents before reaching Ethereum, where they were exchanged for approximately 445,198 DAI. XRPL.to’s on-chain investigation independently traced the same movement, identifying NEAR Intents as part of the transaction route and reporting that the DAI remained at the final Ethereum address.
XRP Healthcare has published the transaction trail and the Ethereum destination address, stating that the funds remain there. The company said it reported the address and contacted exchanges, investigators, and other relevant parties to support potential recovery.
Staking Feature Under Investigation
The security issue has drawn particular attention to the wallet’s staking functionality. Forensic researchers reported that activating staking could cause users’ seed phrases to be transmitted to a remote server. XRPL.to’s analysis found that 1,199 of the affected wallets had evidence of using the staking function, while most of the affected wallets did not show that activity. This means the precise mechanism behind the compromised wallet remains an issue under investigation.
We are on X, follow us to connect with us :- @TimesTabloid1
— TimesTabloid (@TimesTabloid1) June 15, 2025
XRP Healthcare has said it was not aware that the wallet’s staking process transmitted seed information and has demanded a full explanation from the developers responsible for building the application. The company has also said a detailed developer report is forthcoming.
The incident has also renewed criticism from individuals previously associated with the broader XRPL developer community. Although Former Ripple developers have raised earlier concerns about XRP Healthcare’s project and its security practices, some of those historical allegations remain disputed. So it should not be treated as independent facts.
For now, the investigation remains focused on how attackers gained access to thousands of wallets, while the traced DAI remains at the identified Ethereum address. XRP Healthcare’s decision to publish the transaction trail and work with exchanges and authorities could become important to any effort to recover the stolen assets.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
