A security breach on the Tx XRPL bridge led to the theft of nearly 200,000 XRP, valued at $202,000, prompting Tx to suspend operations and investigate.
Summary
- A vulnerability in the Tx XRPL bridge led to the theft of nearly 200,000 XRP, valued at about $202,000.
- The bridge inaccurately recorded transactions as valid deposits despite no XRP being received.
- Tx has suspended the bridge and is working on compensating affected users.
An attack on the XRP Ledger's Tx bridge resulted in the loss of approximately 200,000 XRP, equating to around $202,000, on August 9. The incident was due to a flaw in the software that detects deposits, as reported by Tx, the organization managing the bridge.
In a statement on X, Tx explained that a software malfunction incorrectly classified transactions as deposits when no XRP was actually received. “The attacker took advantage of the bridge's deposit-detection mechanism,” the company noted, revealing that this oversight allowed the creation of bridged XRP on the Tx Chain.
Launched in March, Tx is a layer-1 blockchain ecosystem that combines Coreum with Sologenic, focusing on tokenization and trading based on the XRP Ledger. The attacker exploited the faulty deposit detection to generate unsupported XRP, which was then exchanged for real XRP via the bridge.
Despite undergoing several audits before its launch, this specific vulnerability was overlooked. Analysis from XRPL, an independent trading platform, indicates that the breach resulted in approximately 199,916 XRP being released through 94 transactions over 97 minutes, with 17 out of 28 relayers approving each transaction. These relayers mistakenly identified the attacker’s self-directed transactions as legitimate deposits.
XRPL clarified that earlier claims linking the theft to “rippling,” a feature of XRPL for moving tokens across trust lines, were inaccurate, emphasizing that each transaction was signed by the bridge’s multisig and that native XRP cannot be rippled. The true issue was that a relayer misidentified the attacker’s self-payments as deposits.
Reza Bashash, a principal at CoreNest Capital and co-founder of Sologenic and Coreum, revealed on X that the stolen XRP was converted into Ethereum, moved to the Ethereum network via THORChain, and then sent to the crypto mixer Tornado Cash, complicating tracing efforts.
Tx has since suspended the bridge, corrected the faulty code, and is currently tracking the stolen assets. They have filed a complaint with the FBI’s Internet Crime Complaint Center and are consulting with blockchain forensic experts. Tx stated, “As we explore all legal options, we are also assessing various ways to remedy the situation for affected users.”
The bridge remains offline as Tx reviews its security measures, assuring users that no action is needed from them and warning against any claims of recovery for lost funds. Despite the incident, XRP’s price has remained stable around $1, with a market cap of about $64 billion, though it has seen a 5.5% drop over the past month. Traders on Myriad predict that XRP will retain its $1 price for the week ahead.
