An attacker drained nearly 200,000 XRP — worth approximately $200,000 — from a blockchain bridge connecting the XRP Ledger to the Coreum (tx) network on August 9, 2026. The exploit targeted a software vulnerability that allowed fabricated deposit records to pass scrutiny and trigger legitimate withdrawals from the bridge's reserve wallet.

tx confirmed the incident in a public statement on August 11, 2026:

An update on the XRPL bridge incident. On August 9, the tx XRPL bridge was exploited and XRP was drained from the bridge's reserve wallet on the XRP Ledger. The bridge has been halted, the vulnerability has been identified, and all potential remedies are being evaluated. This…

— tx (@txEcosystem) August 11, 2026

The bridge linked the XRP Ledger to Coreum, a blockchain that rebranded as tx in March 2026 and focuses on tokenizing real-world assets. Blockchain bridges — which connect otherwise incompatible networks by locking assets on one chain and issuing equivalents on another — have been among the most frequently exploited categories of decentralized finance infrastructure. Major incidents involving bridges such as Wormhole, Nomad, and the Ronin Network have collectively resulted in billions of dollars in losses, often stemming from validation flaws rather than cryptographic breaks.

How the Exploit Worked

Blockchain bridges function as vaults with receipt systems. Users deposit XRP into a reserve wallet, and the bridge mints an equivalent amount of wrapped tokens on the destination chain. Returning those tokens allows the user to withdraw the original XRP.

The attacker circumvented this process by obtaining receipts without making actual deposits. The relayer software — responsible for monitoring both blockchains and authorizing transfers — verified whether a payment succeeded and read the memo attached to each transaction. However, it failed to confirm that payments were actually directed to the bridge address.

The attacker exploited this gap by sending wallet-to-wallet transfers with memos formatted to mimic bridge deposits. Relayers interpreted these transactions as legitimate and logged them as real deposits. Once a sufficient number of relayers reached consensus, the system credited balances that had no underlying XRP backing. The attacker then used the standard withdrawal process to extract genuine XRP from the bridge's reserve.

The flaw — a failure to verify the destination address of a payment — falls into a class of input-validation errors that security auditors routinely flag in bridge architecture, where relayers must independently confirm multiple conditions before authorizing cross-chain transfers.

On-Chain Evidence

On-chain analysis traced 199,916.3 XRP leaving the bridge account through 94 payments between 19:16 UTC and 20:53 UTC on August 9 — a span of 97 minutes. Prior to the attack, the bridge held approximately 200,410 XRP. After the drain, only 493.5 XRP remained.

Each outgoing payment carried 17 of 28 relayer signatures, meeting the required majority threshold. Investigators found no evidence that relayer keys were compromised.

Blockchain analysts also dismissed an earlier theory that the XRP Ledger's "rippling" feature was responsible. Rippling applies exclusively to issued assets held through trust lines, whereas native XRP does not use trust lines. All 199,916 XRP exited through bridge-signed payments, not through rippling. The incident stemmed from a flaw in the bridge software connecting the two networks, not from a vulnerability in either blockchain itself.

Movement of Stolen Funds

Following the drain, the stolen XRP was dispersed rapidly. Approximately 169,000 XRP was transferred into two staging wallets that had been created on June 28. An additional 34,000 XRP was moved to three separate addresses. The attacker has not been identified.

Response and Status

tx stated that it has identified and remediated the vulnerable code, engaged blockchain forensics specialists, and filed a report with the FBI's Internet Crime Complaint Center (IC3). The bridge remains halted as the team evaluates potential remedies.

The company has not disclosed how affected users will be compensated or when the bridge will resume operations. The outcome of those decisions will be a key marker for users assessing the platform's handling of the incident and the security of cross-chain infrastructure on the XRP Ledger more broadly.