The Tx project confirmed a security breach on its XRPL bridge that resulted in the loss of approximately 199,916 XRP, valued at around $202,000. The exploit occurred on August 9, 2026, when an attacker leveraged a software vulnerability to mint unbacked tokens on the Tx Chain.
Tx halted the bridge immediately after detecting the issue and filed a report with the FBI Internet Crime Complaint Center. The team has since patched the code and is evaluating options to compensate affected users, though no final decision on restitution has been announced.
Key facts
- The attack involved 94 payments executed over 97 minutes, authorized by 17 of the bridge’s 28 relayers.
- A flaw in the deposit-detection logic allowed the system to register self-directed transactions as valid deposits, even though no XRP was actually delivered.
- The stolen funds were swapped for Ethereum via THORChain and sent to Tornado Cash, a mixing service used to obscure transaction trails.
- Initial theories suggesting the exploit used “rippling” were incorrect, as native XRP cannot ripple and the transactions were signed by the bridge’s multisig wallet.
- Previous security audits failed to identify this specific logical error in the bridge’s code.
Why it matters
This incident highlights the risks associated with cross-chain bridges, which remain frequent targets for attackers due to their complex architecture. It demonstrates how logical flaws in smart contract code can bypass traditional security audits, leading to significant financial losses. Users should remain cautious when interacting with bridging protocols and monitor official channels for updates on compensation and security improvements.