TLDR
- TX Chain reported 198,715.88 XRP stolen from its XRPL bridge during the August 9 exploit.
- A deposit-detection flaw allowed transactions sent elsewhere to register as valid bridge deposits.
- The attacker minted unbacked XRP on TX Chain before withdrawing real XRP from the bridge reserve.
- The stolen XRP was converted to ETH, moved through THORChain and later transferred to Tornado Cash.
- TX Chain halted the XRPL bridge, fixed the vulnerable code and filed a complaint with the FBI.
The bridge connecting TX Chain and the XRP Ledger remains halted after an August 9 exploit drained nearly 200,000 XRP from its reserve wallet. The incident affected bridged XRP on TX Chain, while the XRP Ledger itself and other bridged assets were not compromised.
TX Chain said an attacker exploited a flaw in the bridge’s deposit-detection logic, allowing transactions that did not send XRP to the bridge to register as valid deposits. Those false deposits created unbacked XRP on TX Chain, which the attacker later exchanged for real XRP held in the bridge reserve.
Deposit Detection Flaw Allowed Unbacked XRP Minting
The vulnerability involved the XRPL relayer logic and the ledger’s DefaultRipple feature. The attacker created cross-currency XRPL payments that the relayer detected as incoming bridge transfers, even though those payments went to other XRP Ledger addresses instead of the bridge vault.
Insufficient destination checks allowed the relayer to accept those transactions as genuine deposits. The bridge then minted corresponding XRP on TX Chain without receiving the XRP that should have backed those tokens. The attacker later withdrew XRP from the reserve wallet against the unbacked balance.
Earlier on-chain analysis estimated that 199,916 XRP left the bridge through 94 transactions over about 97 minutes. TX Chain co-founder Reza Bashash later put the stolen amount at 198,715.88 XRP, creating a small difference between initial transaction estimates and the project’s latest reported loss.
The bridge relied on a multisignature system requiring 17 of 28 relayer keys to authorize transactions. The attacker did not obtain those private keys. Instead, the flawed deposit logic caused the relayer system to approve withdrawals based on deposits that had not reached the bridge.
Stolen XRP Converted to ETH and Sent to Tornado Cash
Bashash said the attacker moved the stolen XRP after draining the bridge. The funds were converted into ETH and transferred to Ethereum through THORChain before being sent to Tornado Cash, making further direct tracking more difficult.
TX Chain said it has traced the stolen assets across chains and contacted blockchain forensics specialists. The project also filed a formal complaint with the FBI’s Internet Crime Complaint Center, providing transaction records and other information collected during its investigation.
The project has identified and fixed the code responsible for the vulnerability, although the bridge remains suspended while additional security reviews continue. TX Chain said the affected bridge had undergone internal and third-party audits before deployment, but those reviews had not identified the deposit-detection flaw.
No private keys belonging to the XRP Ledger were compromised during the attack. The exploit targeted the third-party bridge software rather than the underlying XRPL network.
TX Chain Evaluates Remedy for Affected XRP Holders
TX Chain said the incident affected only bridged XRP, which is currently not fully backed following the reserve loss. Other assets using the bridge remain fully backed, while tokens held directly on-chain, on centralized exchanges and on decentralized exchanges were not affected.
The team is evaluating options to address losses faced by holders of affected bridged XRP. Details on the mechanism and timing of any remedy have not yet been released, and the project said users do not currently need to take action.
TX Chain also plans to pursue the identification and prosecution of the attacker while working with security partners and investigators. The XRPL-to-TX Chain bridge will remain halted while the team reviews its systems and adds further safeguards.
