XRP Healthcare said unauthorized transactions that began Sept. 3, 2026, affected approximately 4,011 XRPH Wallets and removed digital assets it valued at roughly $452,000. The company traced the assets from the XRP Ledger through NEAR Intents and Ethereum before they were swapped into DAI through Uniswap V4. About 445,198 DAI remained at the identified Ethereum address as of Sept. 6, while XRP Healthcare sought to have platforms flag the address and explore possible freezes or recovery. No freeze by an exchange or agency had been confirmed. Independent on-chain reporting identified approximately 267,664 XRP and 23.2 million XRPH tokens among the losses. XRPL.to said its decompilation of XRPH Wallet Android build 8.0.15 found a staking-related process that sent a user's seed phrase to a company-controlled server. XRP Healthcare said management had believed the wallet was non-custodial and learned of the code path through that research, but it has not released source code, server logs or a completed independent audit establishing seed exposure as the cause of every drain. Some affected wallets had no staking history, leaving the full access method unresolved. The company said it found no evidence that the XRP Ledger itself caused the breach.