Finst

XRP Bridge Loses $200,000 After Deposit Check Bug

The bridge between the XRP Ledger and Coreum/tx was drained in 97 minutes because of a deposit verification bug. Tx fixed the code and brought in the FBI.

By Zenz van der Wielen
• 2 min read
XRP Bridge Loses $200,000 After Deposit Check Bug

Key Takeaways

  • An XRP bridge lost nearly 200,000 XRP, worth about $200,000, because of a software bug in the deposit check.
  • The attacker claimed deposits that were never made, after which real XRP was withdrawn from the reserve.
  • Tx fixed the vulnerable code and brought in forensic specialists and the FBI Internet Crime Complaint Center.

An XRP bridge lost nearly 200,000 XRP, worth about $200,000 (€173,300) at current prices, after a software bug let an attacker claim deposits that were never made. The bridge connected the XRP Ledger to Coreum, the network that was renamed tx in March, and was drained within 97 minutes before the system was shut down on August 9.

How the Attack Worked

In practice, a bridge works like a safe with a receipt. A user sends XRP to a reserve wallet on the XRP Ledger, after which the bridge issues the same amount of bridged XRP on the other chain. If those tokens come back, the user can withdraw the real XRP from the reserve.

According to tx, the bug was in the software that recorded transactions as deposits, even when no XRP had been sent to the reserve at all. That allowed the attacker to receive bridged XRP on the tx chain without any real backing behind it. Those unbacked tokens were then sent back through the bridge, after which real XRP was withdrawn from the reserve.

The drain started at 19:16 UTC. Each payout was approved by 17 of the bridge's 28 relayers, exactly as the system was designed, because the internal records saw the deposits as valid. The vulnerability was one layer deeper: the relayer code processed payments with the bridge memo without first checking the destination address.

Broader Risk for Bridges

Cross-chain bridges remain a sensitive part of the crypto market, mainly because they connect different networks and depend on tight verification. In 2026, several bridge attacks have already been reported, with sector figures showing more than $328 million (€284 million) in losses across eight major incidents. Earlier hacks, like Ronin and Wormhole, show that this kind of infrastructure has been under pressure for a while.

For European crypto readers, this matters because bridges are often used to move liquidity and tokens between chains, while security relies heavily on software logic and relayers. If that control layer fails, an attack can quickly turn into real losses in reserve wallets, as happened here too.

Tx's Response

Tx said in an update that the vulnerable code has been identified and fixed, that blockchain forensics specialists have been brought in, and that a complaint has been filed with the FBI Internet Crime Complaint Center. The company has not yet said how affected holders will be compensated.

Onchain tracking meanwhile shows that the stolen XRP was moved further within hours through several other addresses. That makes recovering the funds harder, although it is still unclear how much of it remains traceable in the end.

Disclaimer: This content is for informational purposes only and does not constitute financial, investment, legal, or tax advice. The information provided may be incomplete, inaccurate, or outdated and should not be relied upon as such. Nothing on this website should be considered a recommendation to buy, sell, or hold any cryptocurrency. Investing in crypto-assets involves risk of loss.