XRP Bridge Loses Nearly 200,000 XRP to Deposit-Detection Flaw
Security & Exploits ·
An attacker exploited a software bug in the Tx bridge connecting the Tx Chain and the XRP Ledger to mint unbacked tokens and cash them out for real XRP.
Tx, the layer-1 project formed by combining Coreum and Sologenic, disclosed that a flaw in its bridge's deposit-recognition system let an attacker siphon close to 200,000 XRP, worth about $202,000, on August 9, according to Decrypt. The bridge's code logged certain transactions as valid XRP deposits even when no XRP had actually moved into the system, letting the attacker generate bridged XRP on the Tx Chain that had nothing backing it, then swap that phantom balance for genuine XRP through normal withdrawal channels.
Independent analysis from the XRP Ledger tracking platform XRPL found that 94 separate payments went out over a 97-minute window, each cleared by 17 of the bridge's 28 relayer programs, the automated processes responsible for confirming activity across both chains and approving transfers. The relayers reportedly mistook self-directed transactions from the attacker for legitimate incoming deposits, effectively rubber-stamping the exploit. That review also pushed back on early speculation that the funds moved through "rippling," a trust-line mechanism on the XRP Ledger, noting that native XRP cannot travel that way and that every payment carried the bridge's own multisig authorization instead.
Once the XRP was extracted, it was reportedly converted to Ethereum, routed through THORChain onto the Ethereum network, and funneled in full into the Tornado Cash mixer, a move described by a Sologenic and Coreum co-founder as an effort to obscure the trail, per CryptoPotato.
Notably, the vulnerability persisted despite the bridge having gone through multiple internal and third-party security audits before it launched, none of which caught the deposit-verification weakness, a gap also flagged by CoinDesk. Tx has since taken the bridge offline, patched the underlying code, traced the movement of the stolen funds, and filed a report with the FBI's Internet Crime Complaint Center, while also bringing in outside forensics support.
What remains unsettled is how, or whether, affected users will be made whole; Tx says it is weighing compensation options but has not detailed a plan, and the bridge stays offline pending further security review. XRP's market price has shown little reaction, holding near $1 with a roughly $64 billion market cap, though it is down about 5.5% over the past 30 days.