XRP Healthcare's Wallet App Flaw Exposed: 4,011 Wallets Drained for $450k to $452k
Last week, an attacker exploited a flaw in XRP Healthcare's XRPH Wallet app, draining approximately 4,011 wallets and stealing between $450,000 to $452,000 worth of XRP, XRPH, and related tokens within three hours.
XRP Healthcare acknowledged the incident on September 4, denying claims it was a rug pull while confirming that XRPH, XRPHAI, and other assets had been stolen from compromised XRPH Wallets. The team instructed users to stop using the wallet immediately pending further notice.
The root cause of the issue dates back to June 13, 2023, when a defect was introduced into how the app generated wallets. Instead of feeding proper randomness into the XRP Ledger's key-generation function, the app passed in improperly formatted entropy, drastically shrinking the effective keyspace behind every wallet created.
The team revealed that every wallet generated by the app should be treated as compromised due to the deterministic nature of the key derivation process and publicly readable underlying algorithm. Wallets that survived did so only because they held no funds; any future deposit into them remains exposed.