XRP wallet breach prompts ledger security review

TLDR

An XRP Healthcare wallet app built on XRP Ledger was breached, and recent separate attacks have pushed the XRPL ecosystem into a deeper security review.

1. The XRPH Wallet app breach drained about $452,000 from 4,011 wallets, but current reporting says the XRP Ledger core was not compromised.
2. XRPL infrastructure was stress tested by a July manifest storm attack and hardened with the xrpld 3.2.1 hotfix plus telemetry showing abuse has dropped near zero.
3. XRPL features like Batch and Permission Delegation are undergoing formal audits and amendment voting, while users are urged to review wallet security and key storage practices.

Deep Dive

1. What Happened In The Wallet Breach

XRP Healthcares XRPH Wallet app, which runs on XRP Ledger, was taken offline after a security incident that affected 4,011 wallets and resulted in the theft of 267,664 XRP, 23.2 million XRPH, and 2.43 million XRPHAI, worth about $452,000, according to a detailed report on the XRPH Wallet app breach.

Investigators traced the stolen funds through NEAR Intents into ETH and then into DAI held at a single Ethereum address that has not moved. Early findings highlight a critical issue on the app side: wallet seeds were stored unencrypted on phones, and a staking feature sent seeds to XRP Healthcares server, expanding the exposure.

Crucially, preliminary analysis states there is no fault with the XRP Ledger itself so far; the problem appears to be how the XRPH app handled private keys, not a protocol-level failure.

2. How XRP Ledger Security Is Being Reviewed

Separately, the XRP Ledger itself faced a July 31 infrastructure crisis when attackers launched a manifest storm by flooding nodes with thousands of fraudulent validator credentials, forcing them to process junk data. Ripple architect David Schwartz published telemetry from his private XRPL hub showing that, after an xrpld 3.2.1 hotfix, the hub is now rock solid, with nearly zero abuse and stable latency, as detailed in this XRPL infrastructure recovery report.

The hotfix limits manifest sizes and changes caching for unknown nodes, preventing similar resource exhaustion. Follow up metrics reported by another outlet confirm XRPL abuse has dropped near zero and consensus was never interrupted during the attack.

On the feature side, the corrected BatchV1_1 amendment, which lets accounts bundle up to eight transactions with strict authorization rules, has been audited and is being voted on by validators, but remains below the 80 percent threshold needed for activation, as noted in coverage of the Batch upgrade vote.

3. What XRP Users Should Watch Next

For everyday users, the immediate risk is in wallet implementation rather than the XRP Ledger protocol. Apps that store seeds unencrypted or send them to remote servers create a single point of failure regardless of how secure XRPL itself is.

Next, XRPL node operators and developers are watching for continued stability data around xrpld 3.2.1, progress of BatchV1_1 and other audited amendments, and any new disclosures about key management practices in third party wallets and staking services.

Conclusion

The breach of the XRPH Wallet app exposed weaknesses in how one XRP Ledger based wallet handled private keys, not a confirmed flaw in XRPL itself.

At the same time, recent attacks on XRPL infrastructure have triggered a broader hardening cycle, with hotfixes, telemetry driven audits, and careful voting on new features like Batch.

Together, these events underline that protocol security and wallet security must both be strong; XRP users gain resilience by paying attention to both ledger level amendments and the key handling practices of the apps they trust.