XRP Bridge Drained After Software Treats Fake Deposits as Real
Nearly 200,000 XRP, worth about $202,000, was drained from a bridge between the Tx Chain and the XRP Ledger on August 9 after an attacker exploited a flaw in the bridge’s deposit-detection logic. The software incorrectly treated self-directed transactions as real XRP deposits, minted unbacked bridged XRP on Tx Chain, and then let the attacker swap that for genuine XRP. XRPL analysis said about 199,916 XRP was released in 94 payments over 97 minutes, approved by the bridge’s multisig relayers, which misread the attacker’s transactions as deposits. Tx said the bridge had passed internal and third-party audits, but the bug was missed. The stolen funds were reportedly converted to Ethereum, moved via THORChain, and sent to Tornado Cash. Tx halted the bridge, fixed the code, traced the funds, filed an FBI complaint, and is reviewing remedies while the bridge remains offline.
