XRP Bridge Drained After Software Treats Fake Deposits as Real
Tx's XRPL bridge lost nearly 200,000 XRP ($202K) after attacker exploited faulty deposit detection, minting unbacked bridged XRP and swapping it for real XRP. The bridge was halted, funds traced to Tornado Cash, and Tx is evaluating user compensation.
Quick Take
Attacker drained nearly 200,000 XRP ($202K) from Tx bridge.
Flawed deposit detection minted unbacked XRP against fake deposits.
Stolen funds routed via THORChain to Tornado Cash.
Tx halted bridge, fixed code, filed FBI complaint, evaluating compensation.
Market Impact Analysis
BearishSecurity exploit on an XRPL bridge undermines confidence in bridge security, but XRP price has remained stable around $1, limiting immediate price impact.
Speculation Analysis
Key Takeaways
- Attacker drained nearly 200,000 XRP ($202K) from the Tx XRPL bridge after a deposit-detection flaw.
- Software credited transactions without actual XRP delivery, enabling minting of unbacked bridged XRP.
- Stolen funds were converted to ETH, moved via THORChain to Tornado Cash.
- Tx halted the bridge, fixed code, filed an FBI complaint, and is evaluating user compensation.
What Happened
On August 9, an attacker drained nearly 200,000 XRP (about $202,000) from the Tx XRPL bridge. The exploit targeted a software flaw in deposit-detection logic: the bridge recorded transactions as XRP deposits even when no XRP was delivered. That allowed the attacker to mint unbacked bridged XRP on the Tx Chain and swap it for real XRP through the bridge. Tx halted the bridge immediately, corrected the affected code, and began tracing the stolen funds. The company also filed a complaint with the FBI's Internet Crime Complaint Center and hired blockchain forensics specialists. User compensation options are under evaluation.
The Numbers
Nearly 200,000 XRP (about $202,000) left the bridge over 97 minutes across 94 payments. Each payment required authorization from 17 of the bridge's 28 relayers — programs that monitor blockchains and approve transfers. The relayers mistook the attacker's self-directed transactions for legitimate deposits. XRP traded near $1 at the time of the exploit, with a market cap of about $64 billion and a 30-day decline of 5.5%. The stolen XRP was converted to ETH, moved through THORChain, and sent to Tornado Cash.
Why It Happened
The root cause was a flaw in the bridge's deposit-detection software. It incorrectly credited transactions as deposits even when no XRP arrived. That allowed minting of unbacked bridged XRP on the Tx Chain. Analysts at XRPL found the bridge approved 94 payments over 97 minutes, with relayers misclassifying the attacker's self-payments as deposits. The bridge had undergone internal and third-party audits before deployment, but the vulnerability remained undetected. The attack exploited a gap between the two chains' transaction validation, not a fundamental XRPL weakness.
Broader Impact
The exploit highlights persistent risks in cross-chain bridges. Despite prior audits, the deposit-detection flaw slipped through. The attack comes as XRP trades around $1 and market sentiment remains cautious. The bridge remains offline while Tx reviews security. The incident may prompt other bridge operators to reassess deposit verification logic. No user action is required, but the lack of a reopening timeline adds uncertainty.
What to Watch Next
- Monitor Tx's announcements for bridge reopening timelines and compensation plans.
- Watch for updated security audits and any changes to relayer signing policies.
- Track XRP price action — stability near $1 so far, but any broader bridge exploit wave could shift sentiment.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
