A bridge connecting the XRP Ledger to the tx blockchain was exploited, resulting in the loss of nearly 200,000 XRP, valued at approximately $200,000. An attacker leveraged a software vulnerability that misidentified fake deposits as real, allowing them to withdraw genuine XRP.
This incident highlights a critical vulnerability in cross-chain bridge security, demonstrating how software flaws can lead to significant financial losses and erode trust in decentralized finance protocols.
An XRP bridge connecting the XRP Ledger to the tx blockchain has been drained of nearly 200,000 XRP, valued at approximately $200,000, due to a software vulnerability. The flaw allowed an attacker to register fake deposits, which then enabled the issuance of unbacked bridged XRP. This unbacked XRP was subsequently used to withdraw genuine XRP from the bridge's reserve wallet.
The incident began on August 9, with the drain occurring over 97 minutes. The bridge's software incorrectly recognized transactions as valid deposits even when no XRP was delivered to the reserve. Each withdrawal was authorized by a majority of the bridge's 28 relayers, as the system's records indicated the deposits were legitimate.
Tx has since halted the bridge, identified and fixed the vulnerable code, and engaged blockchain forensics experts. The company has also filed a complaint with the FBI's Internet Crime Complaint Center. However, details on how affected holders will be compensated have not yet been provided. Onchain tracking indicates that the stolen XRP has been moved through several addresses.