An attacker drained nearly 200,000 XRP, worth around $202,000, from the Tx blockchain bridge on August 9 by exploiting a flaw in its deposit-detection software. Tx halted the bridge, traced the stolen funds, and filed a complaint with the FBI while it evaluates how to compensate affected users.
An attacker drained nearly 200,000 XRP, worth around $202,000, from an XRP Ledger bridge on August 9 by exploiting a flaw in its deposit-detection software, according to Tx, the project that operates the bridge. Tx connects the Tx Chain to the XRP Ledger through a blockchain bridge, and a software error let it record transactions as deposits even when no XRP had arrived.
How the exploit worked
According to Tx: "The attacker exploited the bridge's deposit-detection logic." The bridge's software registered transactions that never delivered any XRP as deposits, then minted bridged XRP on the Tx Chain against them. The attacker used those fraudulent deposits to create unbacked XRP on the Tx Chain and exchanged it through the bridge for real XRP. Tx said the bridge underwent several internal and third-party audits before deployment, but the vulnerability was not identified.
Independent platform XRPL found that the bridge released approximately 199,916 XRP through 94 payments over 97 minutes, each authorized by 17 of the bridge's 28 relayers, the programs that monitor both blockchains and approve transfers. XRPL said the relayers mistook the attacker's self-directed transactions for deposits, and the attacker then withdrew the resulting unbacked balances through the bridge's normal process. The analysis also rejected an earlier claim that the funds moved through "rippling," an XRP Ledger feature that shifts issued tokens across trust lines, noting that native XRP cannot move that way.
Tracing the stolen funds
Reza Bashash, a principal at CoreNest Capital and co-founder of Sologenic and Coreum, said in a separate post that the attacker converted the stolen XRP to Ethereum, moved it onto the Ethereum network through THORChain, and sent the entire amount to the crypto mixer Tornado Cash. Tx said it halted the bridge, fixed the affected code, traced the stolen funds, and filed a complaint with the FBI's Internet Crime Complaint Center. It also hired blockchain forensics specialists and is working with security partners.
Bridge offline as XRP holds steady
The bridge remains offline while Tx reviews its security, and the project said holders do not need to take any action. Tx warned against accounts or websites claiming they can recover the funds. Despite the exploit, XRP has held near the $1 mark, at roughly a $64 billion market cap, dropping roughly 5.5% over the last 30 days.
Source: Decrypt
Trading involves risk.
Risk Disclaimer
