TL;DR
An XRP bridge linking the XRP Ledger with tx was drained of nearly 200,000 XRP, worth about $200,000, after software mistakenly accepted fake deposits as genuine. The attacker exploited the flaw to create unbacked bridged XRP and then exchanged those synthetic balances for real XRP held in the bridge’s reserve wallet. The unsettling part is that the bridge’s own records convinced its relayers that nothing was wrong. The incident unfolded over 97 minutes on August 9 before operators halted the system and began tracing where the stolen tokens moved throughout the reserve drain.
The bridge was designed to work like a vault paired with digital receipts. Users deposit XRP into a reserve wallet on the XRP Ledger, and an equivalent amount is issued on the connected chain. Returning those bridged tokens should unlock the original XRP. The exploit broke that basic relationship by generating receipts without any real deposit entering the vault. According to tx, the software recognized transactions carrying the bridge’s memo as deposits even when no XRP reached the reserve, allowing the attacker to manufacture claims against genuine funds held there through one repeated mechanism.
The failure also exposed how automated approval can amplify a bad data assumption. The drain began at 19:16 UTC, and each payout was approved by 17 of the bridge’s 28 relayers, a majority operating exactly as designed because the system reported the deposits as legitimate. The core problem sat below the relayer consensus itself: payment-processing code checked the memo but failed to verify the destination address first. Once that missing validation was exploited, the distributed signers effectively authenticated withdrawals based on false internal information rather than detecting the absence of a real deposit across repeated payouts.
Tx says the bridge has been halted, the vulnerable code identified and patched, and blockchain forensics specialists brought in to investigate. The project also filed a complaint with the FBI’s Internet Crime Complaint Center, while onchain tracking showed most of the stolen XRP moving through several addresses within hours. The remaining uncertainty now concerns the users behind the depleted reserve, because tx has not explained how affected holders will be compensated. The episode shows how a narrow software check can undermine an otherwise distributed bridge when every validator relies on the same mistaken record after the incident.
