Bridge Exploited, Nearly $202,000 in XRP Drained
An attacker successfully drained nearly 200,000 XRP, valued at approximately $202,000, from an XRP Ledger bridge on August 9 by exploiting a vulnerability in its deposit-detection software, the project announced.
Tx, the entity operating the bridge that connects the Tx Chain and the XRP Ledger, stated in a post on X that a software flaw caused the bridge to incorrectly record transactions as XRP deposits even when no XRP had actually been received.
“The attacker exploited the bridge’s deposit-detection logic,” the company explained. “The bridge’s software mistakenly registered transactions that never actually delivered any XRP to the bridge as deposits, and subsequently minted bridged XRP on the Tx chain against them.”
Tx is a layer-1 blockchain ecosystem that was launched in March, combining the Coreum blockchain with Sologenic, a tokenization and trading platform built on the XRP Ledger.
The attacker leveraged these fraudulent deposits to create unbacked XRP on the Tx Chain. This unbacked XRP was then exchanged through the bridge for legitimate XRP.
According to Tx, the bridge underwent multiple internal and third-party audits prior to its deployment, but the vulnerability remained undetected.
XRPL, an independent XRP Ledger trading and analytics platform, determined that the bridge released approximately 199,916 XRP through 94 separate payments over a 97-minute period. Each transaction was authorized by 17 of the bridge’s 28 relayers, which are programs responsible for monitoring both blockchains and approving transfers.
XRPL’s analysis indicated that the relayers misinterpreted the attacker’s self-initiated transactions as legitimate deposits. The attacker then proceeded to withdraw the resulting unbacked balances through the bridge’s standard withdrawal process.
The analysis also refuted an initial assertion that the XRP had been siphoned off through “rippling,” an XRP Ledger feature used for transferring issued tokens across trust lines. XRPL clarified that native XRP cannot be moved via rippling.
“A widely circulated warning attributed the incident to ‘rippling’ and an account flag that was enabled by default. However, the ledger data indicates otherwise: each of those payments was signed by the bridge’s own multisig, and native XRP is incapable of being rippled,” XRPL stated. “By examining both public chains, the actual cause is identified as a relayer that mistook the attacker’s own self-payments for deposits.”
In a separate post on X, Reza Bashash, a principal at CoreNest Capital and co-founder of Sologenic and Coreum, detailed the attacker’s subsequent actions. He reported that the stolen XRP was converted to Ethereum, transferred to the Ethereum network via THORChain, and then sent in its entirety to the crypto mixer Tornado Cash, a move that significantly complicates tracing the funds.
Tx confirmed that it has halted the bridge, rectified the compromised code, initiated tracing of the stolen funds, and filed a complaint with the FBI’s Internet Crime Complaint Center. The company has also engaged blockchain forensics specialists and is collaborating with security partners.
“As we pursue all available legal avenues, we are concurrently evaluating all options for rectifying the situation for affected users,” Tx stated.
The bridge remains offline while Tx conducts a comprehensive security review. The project advised XRP holders that no action is required on their part and cautioned against any accounts or websites claiming to be able to recover the stolen funds.
The price of XRP has shown minimal reaction to the network issues. The Ripple-linked token continues to trade around the $1 mark, with a market capitalization of approximately $64 billion, having experienced a roughly 5.5% decline over the past 30 days.
Traders on Myriad, a prediction market developed by Decrypt’s parent company, currently anticipate that XRP will maintain its $1 price point for the remainder of the week.
Leave a Reply