An attacker exploited a software flaw in a bridge connecting the XRP Ledger to the tx blockchain, creating unbacked XRP on another blockchain before exchanging it for real XRP held in reserve
An attacker exploited a software flaw in a bridge connecting the XRP Ledger to the tx blockchain, creating unbacked XRP on another blockchain before exchanging it for real XRP held in reserve.
A bridge connecting the XRP Ledger (XRPL) to the tx blockchain lost nearly 200,000 XRP, worth about $200,000, after an attacker exploited a software flaw that caused the system to recognize deposits that never actually occurred. The incident began on Aug. 9 and lasted about 97 minutes before the bridge was halted.
According to tx, the vulnerability allowed the attacker to create bridged XRP without depositing the corresponding amount of XRP into the bridge’s reserve wallet. The attacker then sent those unbacked tokens back through the bridge and withdrew real XRP from the reserve.
Blockchain bridges are designed to move assets between different networks. When a user sends XRP to a reserve wallet on the XRP Ledger, the bridge creates an equivalent amount of bridged XRP on another blockchain. When the bridged tokens are returned, the original XRP can then be withdrawn from the reserve.
In this case, the system’s deposit detection failed. The bridge’s software incorrectly recognized certain transactions as valid deposits even though no XRP had actually been delivered to the reserve wallet. This allowed the attacker to receive bridged XRP without providing the real assets that were supposed to back them.
The problem involved the bridge’s relayer software, which monitors transactions across connected blockchains and authorizes transfers when the system determines that a deposit has been made. According to tx, the relayer code processed transactions carrying the bridge’s memo without properly verifying the destination address.
As a result, transactions that did not deliver XRP to the bridge’s reserve were still treated as legitimate deposits. The attacker could then use those false balances to withdraw actual XRP from the reserve wallet.
The withdrawals were authorized by 17 of the bridge’s 28 relayers, a majority that approved the transactions based on the bridge’s internal records.
The bridge was halted after the exploit, while the operator identified and fixed the vulnerable code. It also engaged blockchain forensics specialists to investigate the incident and filed a complaint with the FBI’s Internet Crime Complaint Center.
The operator has not yet disclosed how affected holders will be compensated. Meanwhile, onchain tracking showed that most of the stolen XRP moved through several other addresses within hours of the exploit.
The incident highlights the importance of accurate deposit verification in blockchain bridges. When a bridge incorrectly recognizes an asset transfer that never happened, an attacker can potentially create unbacked tokens and use them to claim real assets held in reserve.
Instagram : @asetqu_official
Tiktok : @asetqu_official
Twitter : @AsetQu_Official
