XRPL Ecosystem Hit by Large-Scale Wallet Drain, Former Ripple Devs Cite Red Flags
A recent large-scale wallet drain in the XRPL ecosystem on September 3, 2026, has left thousands of users affected. The attackers drained approximately 267,000 XRP and millions of related tokens from mobile wallets belonging to XRP Healthcare, formerly known as XRPayNet. The stolen funds were quickly transferred to the Ethereum network.
Forensic analysis revealed a critical bug: when staking features were activated, users' private seed phrases were sent to a server. This vulnerability was discovered after thousands of users had their balances drained in just three hours.
Former Ripple developer BiasGoose stated that the incident was 'not news to me,' as he had previously rejected grant applications from the team due to concerns about the project's legitimacy. BiasGoose claimed that the product did not need its own token and that the team had been caught 'blatantly lying about partnerships' in their application.
Security experts Hazard Cookie, formerly of Ripple, and Matt Hamilton also confirmed that auditors had been documenting the project's architectural risks for years. The community has remembered the team as scammers who were 'kicked to the curb as known scammers' during previous market cycles between 2022 and 2024.