tx XRPL Bridge Drained of 199,916 XRP in Deposit Verification Exploit
Key Takeaways
- •The attacker stole approximately 199,916 XRP worth about $200,000 by submitting fabricated deposit proofs that the bridge accepted as legitimate without verifying the underlying transfers.
- •Seventeen of the bridge's 28 relayers approved 94 fraudulent transactions over 97 minutes because all relayers ran the same flawed code that failed to confirm where payments were actually directed.
- •The bridge reserve was left with only 493 XRP valued at roughly $500, depleting 99.7% of its holdings and leaving bridged XRP on the tx chain without sufficient real-token backing.
- •The bridge had passed multiple internal and third-party audits prior to deployment, none of which detected the business-logic flaw that allowed phantom deposits to trigger minting of bridged tokens.
- •tx has not specified how holders of unbacked bridged XRP will be reimbursed, and much of the stolen XRP had already been moved through a chain of other addresses within hours of the attack.
On August 9, 2026, an attacker drained nearly the entire XRP reserve backing the bridge between the XRP Ledger and the tx blockchain. The attacker made off with approximately 199,916 XRP, valued at roughly $200,000, leaving bridged XRP held by tx users without sufficient real tokens for redemption.
tx has since halted the bridge and filed a report with the FBI's Internet Crime Complaint Center.
How the exploit worked
The attacker submitted fabricated proof of deposits that never occurred. The bridge's own records accepted this proof as legitimate.
Under normal operation, the bridge locks actual XRP in a reserve wallet on the XRP Ledger and mints an equivalent amount of bridged XRP on the partner chain. When users return bridged tokens, the system is designed to release the corresponding genuine XRP. Cross-chain bridges have become recurring targets in the crypto sector precisely because they concentrate large pools of real assets in a single reserve wallet that a flaw in the bridging logic can unlock.
The vulnerability allowed the attacker to obtain bridged tokens without first funding the vault. They could then send those tokens back through the bridge to withdraw real XRP from the reserve.
tx confirmed in an official update that its software "incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits," and minted bridged XRP against those phantom deposits.
The relayer software scanned the bridge account for payments containing a tx recipient memo but never verified where the payment was actually directed. A seemingly legitimate memo referenced the attacker's own wallet.
97-minute drain approved by 17 relayers
The drain began at 19:16 UTC on August 9 and lasted 97 minutes, spanning 94 individual transactions.
A clear majority of 17 of the bridge's 28 relayers approved every payout, functioning as the system was designed. Relayers are programs that monitor both chains and authorize a withdrawal when the bridge's records indicate one is due. Because the records showed the deposits as real, the relayers processed them accordingly. All relayers ran the same flawed code and returned the same incorrect result — a configuration that provided redundancy against individual node failures but no diversity of logic that could have caught the error.
The liquidity account paid out 199,916 XRP and was left with 493 XRP, worth approximately $500 — 99.7% of the reserve depleted. tx has acknowledged that bridged XRP on its chain "is not currently fully backed."
An update on the XRPL bridge incident.
On August 9, the tx XRPL bridge was exploited and XRP was drained from the bridge's reserve wallet on the XRP Ledger. The bridge has been halted, the vulnerability has been identified, and all potential remedies are being evaluated. This…
— tx (@txEcosystem) August 11, 2026
https://x.com/txEcosystem/status/2087269579190046895?s=20
Project background and response
tx is a U.S.-based project focused on tokenizing real-world assets (RWAs). It is a rebrand of the Coreum chain, which earlier in 2026 merged the Coreum and Sologenic communities.
In its statement, tx said the bridge had passed "multiple internal and third-party audits prior to deployment," none of which detected the deposit-verification bug. Smart contract audits typically focus on well-known vulnerability classes such as reentrancy, integer overflow, and access control. Business-logic flaws — where individual components function as written but the system as a whole mishandles an edge case like an unfunded deposit — are harder to surface with standard audit tooling and have been at the root of several major bridge exploits in recent years.
The company reported that it has disabled the bridge, fixed the security flaw in its code, engaged blockchain forensic specialists, and filed a report with the FBI. tx has not specified how holders of unbacked bridged XRP will be reimbursed.
Recovery appears uncertain. Within hours of the attack, much of the stolen XRP had already been moved through a chain of other addresses.
XRP dipped to $0.9905 on August 11, marking its first trade below one dollar since November 2024. The token currently trades at $1.01, down 69% year to date.
Bridge exploits in 2026
The incident adds to a series of bridge-related exploits in 2026. As previously reported by Cryptopolitan, an attacker stole approximately $11.5 million from the Verus-Ethereum bridge in May using a forged Merkle proof, bringing total bridge losses to over $328 million across eight major incidents in 2026.
Security firm Blockaid linked that hack to the same class of vulnerability exploited in the 2022 Wormhole and Nomad breaches: the destination chain accepted a proof without linking it to an actual transfer. The tx exploit echoes the same pattern — a bridge trusted data it received without independently confirming that the underlying transfer had taken place.
