According to $XRP Ledger AI Healthcare Platform, $XRP Healthcare, the XRPH Wallet app has been taken offline following a recent security incident.
$XRP Healthcare clarified that the removal of the XRPH wallet apps was done by its team as a security precaution after the incident and not by the attacker.
The wallet is not “gone” because the app is offline. If your funds are still showing on-chain, they are still in your XRPL account.
— $XRP Healthcare (@XRPHealthcare) September 7, 2026
The issue is access through the XRPH Wallet app has been disabled while the compromise is investigated.
We are not going to reopen the affected…
The XRPH wallets still exist on the $XRP Ledger, allowing anyone who knows their XRPL address to independently check their balance and transaction history on-chain without the XRPH Wallet app.
Access through the XRPH Wallet app, however, remains disabled while the compromise is investigated.
What happened?
On September 4, $XRP Healthcare issued a security update for the XRPH wallet regarding multiple unauthorized transactions affecting users, urging them not to use the wallet until further notice.
XRPH confirmed that 4,011 wallets were affected, with about $452,000 in assets taken. The funds were traced to a single Ethereum wallet where about 445,000 $DAI currently sits and has not moved. Its preliminary investigation found no evidence of a fault with the $XRP Ledger itself. The exact method by which the wallet keys were compromised is still being investigated, with further verification required.
267,664 $XRP stolen
$XRP Ledger analytics platform xrpl.to gave a breakdown of the security incident, which it stated happened in three hours.
On the evening of September 3, 2026, an address that did not exist an hour earlier received the entire balance of 4,011 wallets: 267,664 $XRP, 23.2 million XRPH and 2.43 million XRPHAI.
A total of 311,613 $XRP went into NEAR Intents, came out on Ethereum as 178.46 ETH within a minute of each deposit, and became 445,198 $DAI at one address that has not moved since.
According to xrpl.to, XRPH payments are signed on the phone while the seed is stored unencrypted, and the staking feature sends the seed to $XRP Healthcare's server.
1,225 wallets staked, nearly all between December 2023 and July 2024. 1,198 of them were drained, and so was $XRP Healthcare's own staking wallet, whose key only the server holds. Yet seven in ten victims never staked: the exposure is suggested to be the XRPH app's whole user base, not one feature.