An attacker drained nearly 200,000 XRP, worth approximately $202,000, from an XRP Ledger bridge operated by Tx on August 9 by exploiting a vulnerability in the bridge's deposit-detection software. Cross-chain bridges — which lock assets on one blockchain and issue corresponding tokens on another — have been among the most frequently exploited components in decentralized finance, with similar deposit-verification failures contributing to several high-profile bridge breaches in recent years.

In a post on X on Tuesday, Tx — the project that operates the bridge connecting the Tx Chain and the XRP Ledger — explained that a software flaw caused the system to log transactions as XRP deposits even when no XRP had actually been delivered to the bridge.

"The attacker exploited the bridge's deposit-detection logic," Tx wrote. "The bridge's software incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits, and minted bridged XRP on the tx chain against them."

Tx is a layer-1 blockchain ecosystem launched in March through the merger of the Coreum blockchain with Sologenic, an XRP Ledger-based tokenization and trading platform.

Using the fraudulent deposits, the attacker generated unbacked XRP on the Tx Chain and then exchanged it through the bridge for genuine XRP.

Tx stated that the bridge had undergone several internal and third-party audits prior to deployment, but the vulnerability went undetected.

According to an analysis by XRPL, an independent XRP Ledger trading and analytics platform, the bridge released approximately 199,916 XRP across 94 payments over a span of 97 minutes. Each payment was approved by 17 of the bridge's 28 relayers — programs that monitor both blockchains and authorize transfers.

XRPL reported that the relayers misidentified the attacker's self-directed transactions as legitimate deposits. The attacker subsequently withdrew the unbacked balances through the bridge's standard withdrawal process.

The analysis also dismissed an earlier claim that the XRP had been drained via "rippling," an XRPL mechanism that transfers issued tokens across trust lines. Native XRP cannot be moved through rippling, XRPL noted.

"A widely-shared warning blamed 'rippling' and an on-by-default account flag. The ledger says otherwise: every one of those payments was signed by the bridge's own multisig, and native XRP cannot be rippled at all," XRPL wrote. "Reading both public chains together, the real cause is a relayer that mistook the attacker's own self-payments for deposits."

In a separate post on X, Reza Bashash — a principal at CoreNest Capital and co-founder of Sologenic and Coreum — said the attacker converted the stolen XRP to Ethereum, transferred it onto the Ethereum network via THORChain, and routed the full amount through crypto mixer Tornado Cash, substantially complicating any tracing efforts. Tornado Cash was sanctioned by the U.S. Treasury Department's Office of Foreign Assets Control in August 2022, meaning U.S. persons are generally prohibited from interacting with the protocol.

Tx said it halted the bridge, remediated the affected code, traced the stolen funds, and filed a complaint with the FBI's Internet Crime Complaint Center. The project also retained blockchain forensics specialists and is coordinating with security partners.

"As we pursue all legal paths forward, we are simultaneously evaluating all options for remedying the situation for affected users," Tx said.

The bridge remains offline pending a security review. Tx advised holders that no action is required on their part and cautioned against any accounts or websites claiming they can recover the lost funds.

Despite the incident, XRP's price has remained relatively stable, continuing to trade near the $1 mark with an approximate market capitalization of $64 billion, down roughly 5.5% over the past 30 days.