XRP bridge loses nearly 200K tokens after fake deposits exploit software flaw

An attacker drained nearly 200,000 XRP, worth about $202,000, from a bridge connecting the XRP Ledger (XRPL) with the Tx Chain after exploiting a flaw in the software used to detect deposits.

The incident occurred on August 9 and allowed the attacker to create unbacked XRP balances on the Tx Chain. Those balances were then exchanged through the bridge for real XRP held in its reserves.

The incident did not result from a flaw in XRP itself. Instead, the vulnerability was in the bridge's deposit-verification system, which incorrectly treated transactions that did not send XRP to the bridge as legitimate deposits.

How the XRP bridge exploit happened

Tx, the ecosystem operating the bridge, said its deposit-detection software incorrectly recognized certain transactions as XRP deposits even though the bridge had not actually received the tokens.

The attacker exploited this behavior by creating transactions that appeared to satisfy the bridge's deposit conditions. The software then credited the attacker with XRP on the Tx Chain without corresponding XRP being locked in the bridge's reserves.

Those newly created balances could then be used to withdraw genuine XRP from the other side of the bridge.

In simple terms, the attacker was able to convince the bridge that XRP had arrived when it had not. Once the software accepted the fake deposit, the normal withdrawal process released real XRP.

Tx said the vulnerability had gone undetected through multiple internal and third-party audits before the bridge was deployed.

Nearly 200,000 XRP drained in 97 minutes

Blockchain analysis showed how quickly the exploit affected the bridge's reserves.

XRPL's analysis found that approximately 199,916 XRP was released through 94 payments over 97 minutes. Each transaction was authorized by 17 of the bridge's 28 relayers.

Relayers are software programs that monitor activity across the connected blockchains and help determine when a transfer should be processed.

According to the analysis, the relayers effectively treated the attacker's own transactions as proof that XRP had been deposited. The bridge then processed the withdrawals through its regular authorization mechanism.

The attack drained almost the entire XRP reserve backing the bridge. Protos reported that approximately 99.7% of the reserve was lost in the incident.

That makes the exploit significant even though the dollar value of the stolen XRP was relatively small compared with larger crypto hacks.

The exploit was not caused by XRPL rippling

The incident initially led to claims that XRP had been stolen through rippling, an XRPL feature that allows issued assets to move between accounts through trust lines.

However, XRPL's analysis rejected that explanation.

Native XRP is not transferred through the rippling mechanism. Instead, the analysis found that the bridge's own multisignature authorization process approved the withdrawals after its relayers incorrectly identified the attacker's transactions as deposits.

That distinction matters because the underlying XRP Ledger was not responsible for creating the false deposits.

The problem was the bridge's interpretation of activity occurring on the connected chains.

This highlights an important risk with cross-chain bridges: even when the underlying blockchains work as intended, software sitting between them can become a single point of failure.

Stolen XRP was moved through Ethereum

After obtaining the real XRP, the attacker moved the funds across several networks, according to Reza Bashash, a CoreNest Capital principal and co-founder of Sologenic and Coreum.

The stolen XRP was reportedly converted into Ethereum before being transferred onto the Ethereum network through THORChain. The funds were then sent to Tornado Cash, a crypto mixer that can make blockchain transactions harder to follow.

This does not necessarily mean the funds cannot be traced. Blockchain transactions remain publicly visible, and Tx said it has been working with blockchain forensics specialists to track the stolen assets.

The project has also filed a complaint with the FBI's Internet Crime Complaint Center (IC3) as it pursues legal options.

Tx halts bridge and investigates the vulnerability

Following the attack, Tx halted the bridge and said it had fixed the affected code. The bridge remains offline while the team conducts additional security reviews with external security partners.

Tx said it is also evaluating options for addressing the impact on affected users. At the same time, the project warned users about accounts or websites claiming they can recover the stolen funds. The shutdown is designed to prevent additional withdrawals while the team reviews the system.

For bridge users, the immediate issue is therefore less about the XRP Ledger itself and more about whether the bridge can demonstrate that its deposit verification and authorization systems are now secure.

XRP price remains near $1 despite exploit

The exploit has so far had a limited effect on XRP's broader market price.

XRP has remained around the $1 level, with the token's market capitalization near $64 billion based on the source data. XRP was down roughly 5.5% over the previous 30 days, meaning the bridge incident has not created a sharp standalone price reaction.

Recent market data also showed XRP testing the $1 area, with the token trading around $1.01 on August 11.

The relatively muted reaction is understandable because the stolen amount is small compared with XRP's overall market value. More importantly, the exploit targeted a specific bridge rather than the XRP Ledger's core consensus or native XRP.

Prediction-market traders were also largely expecting XRP to remain around the $1 level through the end of the week, according to the source material.

What happens next for XRP and the bridge?

The key issue now is whether Tx can fully validate the bridge's security before reopening it.

The project will likely need to demonstrate that deposits are being verified against actual on-chain settlement rather than relying on transaction patterns that can be manipulated.

The incident also raises broader questions about bridge security. Multiple audits did not identify the vulnerability, yet the attacker was able to use a relatively simple logic failure to create artificial balances and withdraw real assets.

For XRP holders, the immediate takeaway is that the exploit was a bridge-level issue, not evidence that native XRP itself was compromised.

The next major developments to watch are the bridge's reopening, the project's findings from its security review, efforts to trace the stolen XRP and any plan announced to address losses for affected users.

Until those details are clearer, the bridge's security remains the main concern rather than the underlying XRP Ledger.