XRP Healthcare has materially clarified the root cause of the XRPH Wallet incident.
According to the project’s September 8 incident report, a wallet-generation defect introduced on June 13, 2023 dramatically reduced the effective private-key search space.
That made offline reconstruction of private keys computationally feasible.
Scale of the incident
The September 3 drain affected 4,011 wallets.
Reported stolen balances include approximately:
- 267,664 XRP
- 23.2 million XRPH
- 2.43 million XRPHAI
Total loss has been reported at approximately $450,000–$452,000.
Why this is worse than a normal app outage
A key-generation bug is different from an ordinary application bug.
If an old wallet’s private key was generated from a weak deterministic space, updating the software does not make the existing key stronger.
All generated wallets should be treated as compromised
The project says all wallets generated by the affected application should be considered compromised.
A wallet that has not yet been drained may simply have held no value or not yet been targeted.
XRP Ledger itself was not compromised
The incident occurred at the wallet-application/key-generation layer.
There is no evidence in the reviewed reporting that XRP Ledger consensus or XRPL cryptography failed.
Cross-chain fund movement
On-chain analysts traced stolen XRP through NEAR Intents and into Ethereum.
Approximately 445,198 DAI was reported at a traced Ethereum address during the investigation.
Recovery efforts
XRP Healthcare has said it filed a report with law enforcement and is working with crypto platforms to freeze stolen assets.
No full-reimbursement program or confirmed complete asset recovery was identified.
Evidence Status
Confirmed / Project Report via Media + On-chain
- Wallet-generation flaw introduced June 13, 2023.
- Effective keyspace materially reduced.
- 4,011 wallets drained.
- Approximately 267,664 XRP and 23.2M XRPH affected.
- Roughly $450K–$452K total reported loss.
- All app-generated wallets should be treated as compromised.
- XRPH Wallet app taken offline.
Developing
- Exact key-generation implementation.
- Full freeze/recovery.
- Reimbursement.
- Replacement-wallet rollout.
- Final loss after recoveries.
Risk Assessment
High.
What to Watch Next
Replacement wallet, migration instructions, freeze status, DAI movement, reimbursement, law-enforcement action and a complete technical post-mortem.
FAQ
How many wallets were drained?
4,011.
How much was stolen?
Approximately $450,000–$452,000.
Was XRP Ledger hacked?
No evidence indicates an XRPL protocol compromise.
Are undrained XRPH wallets safe?
The project says all wallets generated by the affected app should be treated as compromised.
Can a software update fix an already weak private key?
No.
Were the stolen funds recovered?
Full recovery has not been confirmed.