Former Ripple Devs Flag XRP Healthcare as 4,000 XRPL Wallets Drained in Attack
XRP Healthcare mobile wallets were drained of approximately 267,000 XRP and related tokens, with forensic analysis revealing a critical seed-phrase leak bug.
Why it matters
The incident highlights security vulnerabilities in XRPL ecosystem wallets, with approximately 4,000 wallets affected according to the report. It also raises questions about project vetting in the XRP ecosystem, as former Ripple developers had previously flagged concerns about the team.
Key facts
Stolen funds were transferred to the Ethereum network within three hours
Reported by U.Today
Forensic analysis found that users' private seed phrases were sent to a server when staking features were activated
Reported by U.Today
Approximately 4,000 XRP Ledger wallets were affected by the attack
4,000 walletsReported by U.Today
Developer BiasGoose stated the incident was 'not news to me' and had previously rejected grant applications from the team
Reported by U.Today
XRP Healthcare was formerly known as XRPayNet
Reported by U.Today
David Schwartz revealed operational metrics of his private XRPL hub showing the system had fully recovered and was operating with 'Rock Solid' stability
Reported by U.Today
Schwartz's disclosure covered the period from August 25 to September 8
Reported by U.Today
What happened
On September 3, 2026, mobile wallets belonging to XRP Healthcare (formerly XRPayNet) were drained within the XRPL ecosystem, with attackers stealing approximately 267,000 XRP and millions of related tokens that were transferred to the Ethereum network within three hours, U.Today reported. Forensic analysis uncovered a critical bug in which users' private seed phrases were sent to a server when staking features were activated, according to U.Today. Developer BiasGoose stated the incident was 'not news to me,' saying he had previously rejected grant applications from the team, U.Today reported. Former Ripple developers had reportedly blacklisted the project prior to the incident, U.Today reported. Separately, Ripple CTO Emeritus David Schwartz disclosed operational metrics for his private XRPL hub on September 8, stating the system had fully recovered and was operating with 'Rock Solid' stability following the earlier July 31 manifest storm attack on the network, U.Today reported.
How the story developed
- Update
XRP Healthcare mobile wallets drained of approximately 267,000 XRP
Attackers drained thousands of users' wallets within three hours and transferred funds to Ethereum network
- First report
First report by U.Today
Former Ripple Devs Reveal Critical Red Flags as 4,000 XRP Ledger Wallets Are Affected
- Update
U.Today publishes initial report on wallet drain incident
Report reveals critical bug where seed phrases were sent to server during staking activation
- Update
David Schwartz discloses private XRPL hub metrics showing network recovery
Schwartz reported his hub was operating with 'Rock Solid' stability following the crisis
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 6 Sept 2026, 16:51 UTC: U.Today — 1 independent source, 1 reports
- 8 Sept 2026, 12:10 UTC: U.Today — 2 independent sources, 2 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| U.Today Crypto media | Former Ripple Devs Reveal Critical Red Flags as 4,000 XRP Ledger Wallets Are Affected | Original | |
| U.Today Crypto media | Ripple's Veteran Schwartz Discloses Private XRP Ledger Hub Health After Network-Wide Attack | Syndicated |
Related events
XRP Slides on Failed Clarity Act as XRP Ledger Advances Batch Upgrade, Lending and AI Payment Support
XRP dropped sharply after the Clarity Act failed in the US Senate, while the XRP Ledger progressed a validator upgrade, released version 3.4.0 with lending amendments, and added AI-agent payment support.
XRP drops below $1.30 on CLARITY Act failure and Fed rate hike before rebounding on whale accumulation
XRP fell below $1.30 after a failed Senate vote on the CLARITY Act and a Fed rate hike, then recovered above $1.40 as whales accumulated 1.54 billion tokens over 96 hours.
BIS Tests XRPL for Data Verification as Ripple Expands Institutional Partnerships
The Bank for International Settlements tested the XRP Ledger for verifying official statistics, while Ripple struck a branding deal with the University of Florida.
