A software vulnerability in a blockchain bridge connecting the XRP Ledger to the TX blockchain enabled an attacker to fabricate deposits and withdraw nearly 200,000 XRP—approximately $200,000—from the bridge's reserve wallet.

The exploit, which occurred on August 9, 2026, revealed a flaw in the bridge's deposit verification process. The system incorrectly recognized nonexistent transactions as valid deposits, allowing the attacker to generate bridged XRP that was not backed by corresponding assets in the bridge's reserves. The attacker then converted these unbacked tokens into genuine XRP, effectively removing real assets from the bridge's controlled reserves.

Cross-chain bridges like this one are a foundational piece of decentralized finance infrastructure, locking assets on one blockchain and issuing corresponding representations on another so users can transact across otherwise incompatible networks. Because these bridges custody real reserves to back bridged tokens, they have become frequent targets for attackers. Major bridge exploits—including the Ronin Bridge hack in March 2022 that drained roughly $625 million and the Wormhole bridge exploit in February 2022 that resulted in approximately $320 million in losses—have made bridge security one of the most closely scrutinized areas of the blockchain industry.

Bridge Halted After Security Breach

Upon discovering the exploit, the bridge operator immediately suspended the service to prevent further fraudulent deposits and withdrawals while developers investigated the underlying software issue. The operator subsequently patched the vulnerability to prevent attackers from repeating the exploit and generating additional unbacked assets.

The response also involved blockchain forensics specialists, whose role includes tracking the movement of stolen XRP, identifying addresses linked to the attacker, and reconstructing how funds were transferred following the initial withdrawal. The operator additionally filed a complaint with the Federal Bureau of Investigation, bringing federal law enforcement into the investigation.

An update on the XRPL bridge incident.

On August 9, the tx XRPL bridge was exploited and XRP was drained from the bridge's reserve wallet on the XRP Ledger. The bridge has been halted, the vulnerability has been identified, and all potential remedies are being evaluated. This…

— tx (@txEcosystem) August 11, 2026

Technical Root Cause

Developer Reza Bashash provided a technical explanation of the exploit:

The bridge between the TX Chain and XRP Ledger (XRPL) was exploited due to a bug in the XRPL relayer logic combined with the XRPL DefaultRipple feature.

The attacker constructed cross-currency XRPL payments that, due to DefaultRipple, were detected by our relayer as incoming…

— Reza Bashash (@rezabashash) August 11, 2026

The XRPL DefaultRipple feature referenced by Bashash is an account-level setting on the XRP Ledger that governs whether an account participates in rippling—path-based cross-currency payments that the ledger natively supports. When enabled, this feature affects how certain payment transactions are interpreted by network participants, which in this case contributed to the relayer misclassifying the attacker's transactions.

Stolen XRP Moves Through Multiple Addresses

A significant challenge in recovering the assets is the speed with which the stolen XRP moved after the exploit. The funds were transferred through multiple blockchain addresses, complicating tracking efforts and potentially hindering attempts to freeze or recover them. Unlike traditional financial systems, blockchain transactions are generally irreversible once confirmed. While transaction histories remain publicly traceable on many networks, identifying the individuals controlling specific addresses and recovering transferred assets can prove difficult.

The movement of the XRP also creates uncertainty for users who may have been indirectly affected by the exploit. The operator has not yet established how holders of potentially affected bridged assets will be compensated.

Compensation Remains Unclear

The financial impact of the incident appears relatively limited compared to some larger blockchain exploits, but the episode raises broader questions about the safeguards used by cross-chain bridges. Bridge operators must verify that assets deposited on one network actually exist before issuing corresponding assets on another. A failure in that verification process can allow attackers to create tokens without providing underlying collateral, turning a technical flaw into a direct loss of reserve assets.

The operator's decision to halt the bridge and repair the vulnerability reduces the immediate risk of further exploitation. However, determining the fate of the stolen XRP remains a separate challenge. With funds already distributed across multiple addresses, investigators and blockchain forensic specialists will need to trace the transaction trail and determine whether any assets can be identified or recovered.

The incident also leaves users awaiting clarity on compensation. Until the investigation establishes the full scope of the losses and the location of the stolen XRP, it remains uncertain whether affected holders will receive full reimbursement or whether another recovery mechanism will be adopted.

For the broader blockchain industry, the exploit serves as another reminder that cross-chain infrastructure can introduce significant security risks. Even when the underlying blockchain remains secure, vulnerabilities in the software connecting separate networks can expose reserves to unauthorized withdrawals and create losses for users and operators alike. The incident underscores the importance of independent deposit verification, transaction validation, and continuous security monitoring for bridges that hold or transfer valuable digital assets across blockchain networks.