XRP Bridge Hit by $200,000 Loss as Software Accepts Fake Deposits

An XRP bridge lost more than 196,000 XRP tokens valued at around $200,000 (roughly Rs. 1.9 crore) due to a bug in a software program that allowed an attacker to withdraw funds and claim deposits from fake balances. The bridge linked the XRP Ledger with Coreum, a different blockchain network that rebranded under the name “tx,” a US company specialising in tokenisation of real-world assets. The XRP tokens got out of the bridge's reserve wallet within 97 minutes on August 9th before its shutdown.  

Bridge Relayers Approved Withdrawals Based on False Deposit Records

To explain the attack a little more, a bridge should operate like a vault that has a ticketing system. A user will send the XRP tokens to a reserve wallet in the XRP Ledger, and the bridge will generate the same number of bridged XRP tokens in the other chain. Handing back these tokens would allow the user to redeem the actual XRP kept in the reserve. The attacker discovered how to exploit the system to produce these receipts without any deposit in the vault.

As per tx, the software used by the bridge considered transactions to be deposits, although it did not actually send XRP to the bridge. This meant that the attacker received bridged XRP on the tx chain without having the actual XRP that was supposed to back the tokens. The unbacked tokens were then reversed via the bridge, and the attacker received actual XRP from the reserve.

The draining process commenced at 19:16 UTC. Every transaction was approved by 17 of the 28 relayers who operate the bridge, constituting a majority that signed off exactly as intended, since the bridge's ledger indicated the deposits were genuine. Relayers are programs that monitor blockchain transactions and authorise payments based on what the bridge data indicates to be an owed withdrawal. The exact problem occurred one layer down from this in that the relayer software was processing payment memos for the bridge without validating the destination address first.

Tx announced its confirmation of the bug in detecting the deposits in one of its updates, claiming that the attacker took advantage of software that had mistakenly identified the transactions sending zero XRP to the reserve. The firm added that it has identified and patched the problematic code, contacted experts in blockchain forensics, and reported the case to the FBI Internet Crime Complaint Center. 

According to DefiLlama, the second quarter of 2026 is already the most hacked quarter on record in terms of the number of attacks, with 83 hacks of crypto protocols. KelpDAO's $293 million (roughly Rs. 2,774 crore) hack and Drift Protocol's $280 million (roughly Rs. 2,652 crore) exploit were the largest incidents of the quarter.