The tx bridge, which facilitates asset transfers between the XRP Ledger and the tx blockchain, was exploited for nearly 200,000 XRP on Aug. 9. The stolen tokens were worth approximately $202,000 at current market rates. The breach unfolded over 97 minutes, beginning at 19:16 UTC, before tx operators halted the bridge.
The exploit turned on a deposit-detection flaw. The bridge's software registered transactions as valid incoming deposits even when no XRP was delivered to the reserve wallet. That allowed the attacker to mint unbacked bridged XRP on the tx chain without locking any real assets on the XRP Ledger, then redeem those tokens for real XRP held in reserve.
Bridge relayers approved the withdrawals. Of the bridge's 28 relayers, 17 signed off on the payouts—operating exactly as programmed, validating transfers against the bridge's corrupted internal records rather than independently verifying actual XRP delivery to the destination address.
tx, which rebranded from Coreum in March to focus on tokenizing real-world assets, confirmed the exploit. The project said its software incorrectly treated transactions that delivered no XRP to the reserve as valid deposits, creating the opening for the drain.
After discovering the breach, tx halted the bridge and patched the vulnerable code. The project engaged blockchain forensics firms to trace the stolen assets and analyze the attack vector.
tx also filed a complaint with the FBI's Internet Crime Complaint Center. The project has not released a plan for compensating affected token holders, and it remains unclear how users whose XRP was held in the drained reserve will be made whole.
The lock-and-mint model underpinning most cross-chain bridges requires every wrapped token to be backed by an asset locked in reserve. The tx exploit bypassed that requirement, generating tokens with no backing that were then redeemed for real value.
On-chain analysis showed the nearly 200,000 XRP moved through several intermediary addresses within hours of the breach—a standard obfuscation tactic that complicates asset recovery. XRP was trading at $1.012 at the time of publication.
The breach was a logic error in deposit validation, not a private key compromise—a distinction that points to the need for independent verification at every layer of bridge infrastructure, not just at the signing threshold.
