Fake deposits emptied the tx bridge while 17 relayers signed every payout

On August 9 an attacker drained almost the entire reserve of XRP that supports the bridge between the XRP Ledger and the tx blockchain. The take was about 199,916 XRP, or about $200,000.

This leaves the bridged XRP that tx users have without the real tokens they are supposed to redeem it for. The operator has closed the bridge, and the FBI has been alerted.

Fake deposits emptied the reserve in 97 minutes

The attacker fed the bridge fake proof of deposits that never happened. The bridge’s own records assumed that the proof was real.

The bridge locks actual XRP in a reserve wallet on the XRP Ledger and mints an equivalent amount of bridged XRP on the partner chain. Returning the bridged tokens should release the genuine ones.

This loophole allowed the attacker to obtain the bridged tokens without funding the vault, then send those tokens back through the bridge to pull real XRP out of the reserve.

tx confirmed in its own update that its software “incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits” and minted bridged XRP against those phantom deposits.

The relayer software would scan the bridge account for payments with a tx recipient memo but never check where the payment was actually headed. A seemingly legit memo referenced the attacker’s own wallet.

The drain began at 19:16 UTC and lasted 97 minutes, flowing through 94 individual transactions.

A clear majority of 17 of the bridge’s 28 relayers approved every payout, the way the system was designed to work. Relayers are programs that listen to both chains and clear a withdrawal if the bridge’s records say that there is a withdrawal due.

The records said the deposits were real, and the relayers did their job. They all ran the same buggy code, and they all returned the same wrong answer.

The liquidity account paid out 199,916 XRP and was left with 493 XRP, worth about $500. That’s 99.7% of the reserve now depleted. tx has admitted that bridged XRP on its chain “is not currently fully backed.”

An update on the XRPL bridge incident.

On August 9, the tx XRPL bridge was exploited and XRP was drained from the bridge’s reserve wallet on the XRP Ledger. The bridge has been halted, the vulnerability has been identified, and all potential remedies are being evaluated. This…

— tx (@txEcosystem) August 11, 2026

Crypto bridges keep bleeding in 2026

tx is a U.S. based project, which aims to tokenize real-world assets (RWAs). It’s the rebrand of the Coreum chain, which earlier this year merged the Coreum and Sologenic communities.

In its statement, tx said the bridge had passed “multiple internal and third-party audits prior to deployment,” which did not catch the deposit-detection bug.

The company said it has disabled the bridge, fixed the security flaw in its code, hired blockchain forensic specialists, and filed a report with the FBI’s Internet Crime Complaint Center.

It has not specified how holders of unbacked bridged XRP will be reimbursed. Recovery seems difficult. Within hours, much of the stolen XRP had already been transferred to a chain of other addresses.

XRP dipped to $0.9905 on August 11, its first trade under a dollar since November 2024. The coin currently trades at $1.01, down 69% on the year.

Cryptopolitan reported in May that an attacker had stolen about $11.5 million from the Verus-Ethereum bridge with a forged Merkle proof, bringing bridge losses to over $328 million in eight major incidents in 2026.

Security firm Blockaid linked that hack to the same kind of vulnerability exploited in the 2022 Wormhole and Nomad breaches. The destination chain accepted a proof but did not link it to an actual transfer.

The smartest crypto minds already read our newsletter. Want in? Join them.