Software Flaw Enables 200,000 XRP Theft from Tx Cross-Chain Bridge

Deposit Detection Flaw Enables Massive Drain

A sophisticated attacker successfully extracted nearly 200,000 XRP, valued at approximately $202,000, from the Tx bridge on August 9 by exploiting a critical flaw in the platform’s deposit-verification system. According to Tx, the company operating the cross-chain bridge connecting Tx Chain and the XRP Ledger, the vulnerability allowed the attacker to create fraudulent deposit records without actually transferring XRP to the bridge.

The core issue centered on how the bridge’s software validated incoming transactions. Rather than confirming that XRP had actually arrived before registering a deposit, the system accepted transaction records as proof of deposits even when no actual assets were received. The attacker weaponized this oversight by generating fake deposit entries, which the bridge then converted into legitimate-appearing XRP tokens on the Tx Chain. These unbacked tokens were subsequently swapped through the bridge for authentic XRP drawn from the reserve pool.

Attack Mechanics Exploited Relayer Authentication

The theft unfolded rapidly over 97 minutes through 94 separate withdrawal transactions, each requiring authorization from 17 of the bridge’s 28 relayers—validator nodes responsible for monitoring both blockchains and approving cross-chain transfers. These relayers mistook the attacker’s self-directed transactions for legitimate deposits, inadvertently rubber-stamping the unauthorized withdrawals without triggering security alerts.

The vulnerability proved particularly concerning given that the bridge had undergone rigorous security evaluation before launch. Tx conducted internal audits while multiple third-party security firms reviewed the code, yet none identified this critical flaw. Tx operates as a layer-1 blockchain ecosystem established in March through a merger of the Coreum blockchain with Sologenic, an XRP Ledger-native tokenization and trading protocol.

Independent analysis by XRPL, an XRP Ledger analytics platform, pinpointed exactly 199,916 XRP extracted across the attack window. Investigators also debunked an initially circulated theory attributing the theft to “rippling,” an XRPL feature that moves issued tokens across trust lines. Since native XRP cannot be rippled and all payments bore signatures from the bridge’s multisignature wallet, the root cause definitively traced back to relayer confusion over fraudulent deposit signals.

Response and Fund Recovery Efforts

Tx immediately suspended the bridge and deployed code fixes addressing the deposit-detection logic. The company subsequently traced the stolen XRP’s journey through multiple networks: the attacker converted the funds to Ethereum, routed them via THORChain’s cross-chain protocol, and deposited the entire balance into Tornado Cash, a privacy mixer that obscures transaction origins and complicates fund recovery.

Tx filed a complaint with the FBI’s Internet Crime Complaint Center and engaged blockchain forensics specialists to pursue investigative leads. The company is currently developing a compensation framework for affected users, though implementation timelines remain unannounced.

This breach underscores the security challenges facing emerging cross-chain infrastructure critical to XRP’s interoperability vision and the broader multi-chain ecosystem.

Source: Tx, via Decrypt. Not financial advice.