XRP Healthcare Wallet Vulnerability Leads to $450,000 Theft

According to ME News, on September 8 (UTC+8), XRP Healthcare, a health platform built on the XRP Ledger, released a full incident report stating that a wallet generation flaw introduced on June 13, 2023, significantly reduced the effective key space, making offline private key reconstruction computationally feasible. This vulnerability led to the theft of 4,011 wallets on September 3, resulting in losses of approximately $450,000 in crypto assets. According to data from the on-chain analytics platform xrpl.to, the compromised wallets collectively lost 267,664 XRP and 23.2 million XRPH tokens. The development team warned that all wallets generated by the application—not just the 4,011 that were stolen—should be considered compromised; the remaining wallets were not affected only because they held no funds at the time, but they remain at risk if funds are deposited in the future. As of the report’s release, the vulnerability had not yet been patched, and the key derivation algorithm is deterministic and publicly readable. The team had previously acknowledged the incident on September 4, denying allegations of a rug pull; submitted a formal report to law enforcement on September 5; collaborated with other crypto platforms to freeze stolen assets; and stated on September 6 that they had completed full fund tracing, with approximately 445,198 DAI still remaining at a single Ethereum address. (Source: Foresight News)