Fake Deposit Vulnerability in XRP Bridge: 200,000 XRP Stolen in 97 Minutes
The bridge between the XRP Ledger and the tx network lost approximately 200,000 XRP (around $200,000) after its software mistook fake deposits for real ones, leading to its suspension following the attack.
The attack began on August 9 at 19:16 UTC. Assets in the reserve wallet of the bridge—which operates between the XRP Ledger and Coreum and was rebranded as tx in March—were withdrawn through various transactions over a total of 97 minutes.
Bridges typically function like a vault and receipt system. When a user sends XRP to the reserve wallet, an equivalent amount of bridged XRP is created on the other blockchain. When these assets are sent back, the actual XRP held in reserve can be withdrawn. In this incident, the attacker managed to obtain receipts without depositing any XRP into the system.
Fake Deposit Vulnerability in the XRP Bridge
According to the statement from tx, the software recorded transactions as deposits even when no actual XRP reached the reserve wallet. Through these fake deposit records, the attacker received unbacked bridged XRP on the tx network and withdrew the real XRP from the reserve by sending these tokens back across the bridge.
17 of the 28 relayers in the payment approval system signed the transactions, trusting that the deposits appeared legitimate in the bridge’s records. These programs, which monitor other blockchains, approve transfers when a withdrawal liability is created according to the bridge’s own logs. It was stated that the vulnerability stemmed from the relayer code failing to verify the destination address in transactions carrying the bridge memo.
tx announced that it has identified and fixed the vulnerability, appointed blockchain forensic experts, and filed a report with the FBI’s Internet Crime Complaint Center. However, it has not yet been announced how the losses of affected users will be covered. On-chain tracking data showed that the majority of the stolen XRP was sent to various addresses within a few hours.