XRP Healthcare Shuts Down Amid App Flaw Heist

XRP Healthcare has shut down operations after an attacker drained 4,011 wallets tied to its XRPH Wallet app, stealing an estimated $450,000 to $452,000 in XRP, XRPH, and related tokens. The incident occurred over roughly three hours last week.

The problem was caused by a flaw in the wallet application itself, not a breach of Ripple's XRP Ledger or a quantum-computing attack on XRP's underlying cryptography. According to XRP Healthcare's own technical report, the issue stemmed from a defect introduced into how the app generated wallets back on June 13, 2023.

The defect caused the app to pass improperly formatted entropy to the XRP Ledger's key-generation function, drastically shrinking the effective keyspace behind every wallet created. This made offline reconstruction of private keys 'computationally feasible,' allowing an attacker to drain funds from compromised wallets.

XRP Healthcare is advising affected users to stop using the XRPH Wallet app and has begun winding down operations following nearly three years in business. The company's development team acknowledged that every wallet generated by the app should be treated as compromised, not just those drained during the incident.