XRP bridge drained for $200,000 after software mistook fake deposits for real ones
Reported by CoinDesk · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
Nearly 200,000 XRP, valued at about $200,000, were stolen from a bridge linking the XRP Ledger to the tx blockchain due to a software bug. The vulnerability allowed the bridge to register fake deposits as real, issuing unbacked bridged XRP that the attacker then exchanged for genuine XRP from the reserve wallet. Tx, the U.S.-based operator of the bridge, halted the system, patched the flaw, engaged blockchain forensics experts, and filed an FBI complaint.
Why it matters
The incident reveals a critical security flaw in the bridging process between blockchains, undermining trust in mechanisms that enable cross-chain token transfers. By exposing how a missing verification step can lead to unbacked token issuance and theft, the event highlights risks for users relying on bridges and the importance of thorough validation in such systems.
Key context
The bridge connected the XRP Ledger and the Coreum blockchain, which rebranded to tx earlier in 2026. Bridges operate by locking tokens on one chain and issuing equivalent "bridged" tokens on another, functioning like a vault and receipt system. In this case, the bridge issued receipts for fake deposits that never actually transferred XRP into the reserve wallet. The attacker exploited a flaw in the relayer software, which approved payouts based on the bridge’s erroneous deposit records without verifying the actual transfer.
Key numbers and entities
The stolen amount was nearly 200,000 XRP, worth approximately $200,000. The bridge was managed by tx, a U.S.-based company focused on tokenizing real-world assets. The attack began at 19:16 UTC on August 9, 2026, and involved 17 of 28 relayers approving the fraudulent payouts.
What remains unclear
Tx has not yet disclosed how affected holders will be compensated or detailed the full scope of potential remedies. The ultimate disposition of the stolen XRP remains uncertain, though onchain tracking shows the funds moved through multiple addresses within hours. The source does not flag other specific open questions.