The XRP bridge lost approximately $200,000 due to a software vulnerability that allowed counterfeit XRP to be created and withdrawn.
Software Flaw Facilitates Counterfeit XRP Transactions
The XRP bridge has suffered a significant loss of approximately 200,000 XRP, equivalent to around $200,000, due to a software vulnerability. An attacker was able to exploit this flaw, allowing them to generate fake deposits and withdraw genuine XRP from the bridge's reserves.
This incident occurred on August 9, when the bridge, which connects the XRP Ledger to the tx blockchain, was compromised within a short span of 97 minutes. The bridge's operations have since been suspended as the team works to address the issue.
The exploit took advantage of a system that mistakenly recognized non-existent deposits as legitimate transactions. This allowed the attacker to create receipts for XRP that was never deposited, ultimately leading to the unauthorized withdrawal of real XRP from the bridge's reserve.
According to the tx team, the unauthorized transactions began at 19:16 UTC, with 17 of the 28 relayers approving the withdrawals based on the incorrect records. These relayers are responsible for monitoring the blockchains and authorizing transactions based on the bridge's data.
The tx team has acknowledged the flaw and is currently collaborating with blockchain forensic experts to investigate the incident. They have also reported it to the FBI's Internet Crime Complaint Center. However, no details have been provided regarding potential compensation for affected users.
In response to the exploit, tx has implemented fixes to the vulnerable code and is exploring ways to mitigate the impact on users. Meanwhile, the stolen XRP has been quickly moved through various addresses, indicating efforts to launder the funds.
An update regarding the XRPL bridge incident.
On August 9, the tx XRPL bridge was exploited, resulting in XRP being drained from the bridge's reserve wallet on the XRP Ledger. The bridge has been suspended, the vulnerability identified, and all possible remedies are being considered.
— tx (@txEcosystem) August 11, 2026
