XRPH Wallet Taken Offline After Incident Affecting 4,011 Wallets
XRP Healthcare is keeping the app closed while the investigation continues; the affected wallets are still visible on the XRP Ledger. Staking and key management are also under review.
Key Takeaways
- XRP Healthcare took the XRPH Wallet app offline after a security incident that affected 4,011 wallets and about $452,000 was stolen.
- According to the company, the wallets still exist on the XRP Ledger, but users cannot log in through the app for now.
- Analysis platform xrpl.to reported that multiple assets were moved, while the exact cause has not yet been independently confirmed.
XRP Healthcare took the XRPH Wallet app offline after a security incident that affected 4,011 wallets and about $452,000 (€389,200) in assets was stolen. The company says the app will stay closed for now while the investigation continues. The wallets themselves still exist on the XRP Ledger, but users cannot log in through the app for now.
What We Know
According to XRP Healthcare, the stolen assets include 267,664 XRP. The company stressed that it took the app offline as a precaution, not the attacker. Anyone who knows their own XRPL address can still check balances and transaction history on-chain, separate from the app.
The report fits into a broader wave of security problems around crypto apps, where key management is often the weak spot. In this case, the preliminary analysis points to a problem with how access and keys were handled in the wallet app, but the exact cause has still not been independently confirmed.
Money Flow and Analysis
Analysis platform xrpl.to reported that an address that did not exist an hour earlier suddenly received the full balance of the 4,011 wallets at once. In addition to 267,664 XRP, the platform also mentions 23.2 million XRPH and 2.43 million XRPHAI. xrpl.to also says that 311,613 XRP went to NEAR Intents, after which 178.46 ETH appeared on Ethereum within a minute per deposit and eventually 445,198 DAI ended up in one address that has not moved since.
That last amount is not the same as the earlier 267,664 XRP. The figures refer to different steps in the money flow and should not be confused with each other. XRP Healthcare already warned users on September 4, 2026, not to use the wallet anymore after multiple unauthorized transactions were reported.
Why This Matters for Users
For European crypto users, this incident shows how important it is to tell the difference between a wallet app and the underlying chain. If an app goes offline, that does not automatically mean all funds are gone, but it can temporarily block access and management. The incident also highlights that extra features like staking in a wallet can add extra risk if key management is not set up properly. Earlier, a vulnerability in multiple crypto wallets also showed how quickly weak seed or key generation can lead to widespread damage.
