Summary
- An attacker exploited a vulnerability, draining almost 200,000 XRP, valued at around $202,000, from the Tx XRPL bridge.
- The bridge mistakenly credited transactions as valid deposits despite no XRP being received.
- Tx has suspended the bridge and is exploring options to compensate affected users.
A recent attack on an XRP Ledger bridge resulted in the theft of nearly 200,000 XRP, approximately worth $202,000, on August 9. This breach was made possible due to a flaw in the deposit detection software, according to the project.
In a post shared on X, Tx, which manages the bridge linking the Tx Chain with the XRP Ledger, explained that a software malfunction led to transactions being recorded as deposits even though no XRP was actually received.
Myriad: Predict the next move for XRP. Click here to make your prediction.“The attacker took advantage of the bridge's deposit-detection mechanism,” the company stated. “The software inaccurately registered transactions that did not actually deliver XRP as deposits, allowing the creation of bridged XRP on the Tx Chain.”
Tx is a layer-1 blockchain ecosystem that was launched in March, merging the Coreum blockchain with Sologenic, a platform for tokenization and trading based on the XRP Ledger.
The attacker utilized these fraudulent deposits to generate unsupported XRP on the Tx Chain, which was then exchanged for actual XRP via the bridge.
Tx indicated that the bridge had undergone multiple internal and external audits prior to its launch, but this particular vulnerability remained undetected.
According to XRPL, an independent trading and analytics platform for XRP Ledger, the breach resulted in the release of approximately 199,916 XRP through 94 transactions within a span of 97 minutes. Each transaction received approval from 17 out of the bridge’s 28 relayers, which are programs responsible for overseeing both blockchains and authorizing transfers.
XRPL reported that the relayers misinterpreted the attacker’s self-directed transactions as legitimate deposits, allowing the attacker to withdraw the resulting unsupported balances through the bridge's standard procedures.
This analysis dismissed earlier claims suggesting that the XRP had been drained via “rippling,” a feature associated with XRPL that facilitates the movement of issued tokens across trust lines, noting that native XRP cannot be moved in this manner.
“A widely circulated warning attributed the issue to ‘rippling’ and a default account flag. However, the ledger clarifies: each of those payments was signed by the bridge’s own multisig, and native XRP cannot be rippled,” XRPL explained. “Examining both public chains, the true cause was a relayer that mistook the attacker’s self-payments for deposits.”
In another post on X, Reza Bashash, a principal at CoreNest Capital and a co-founder of Sologenic and Coreum, revealed that the attacker converted the stolen XRP into Ethereum, transferred it onto the Ethereum network via THORChain, and subsequently sent the entire sum to the crypto mixer Tornado Cash, complicating efforts to trace the funds.
Tx has halted the bridge, rectified the affected code, tracked the stolen assets, and lodged a complaint with the FBI’s Internet Crime Complaint Center. Additionally, it has engaged blockchain forensic experts and is collaborating with security partners.
“As we explore all legal options moving forward, we are also assessing various ways to remedy the situation for affected users,” Tx stated.
The bridge remains offline as Tx evaluates its security measures. The project reassured holders that no action is required on their part and cautioned against any accounts or websites claiming they can recover the lost funds.
Despite these issues, XRP's price has remained stable, fluctuating around the $1 mark, with a market capitalization of about $64 billion. The token has dropped approximately 5.5% over the past 30 days.
Traders on Myriad, a prediction market developed by Decrypt's parent company, currently anticipate that XRP will maintain its $1 price point for the remainder of the week.