Attack on cross-chain bridge tx: hacker drained XRP Ledger reserves of $200,000
The XRP Ledger ecosystem has faced a serious challenge: on August 9, an attacker successfully exploited a vulnerability in the cross-chain bridge of the tx project, which connects XRP Ledger with their own blockchain. As a result of the attack, the bridge's reserve wallet was completely drained — approximately $200,000 in XRP was stolen.
My analysis of the incident shows that the root of the problem lies in the deposit processing logic. The bridge mistakenly accepted transactions without an actual XRP transfer as real incoming funds. Based on these fictitious records, the system generated "wrapped" tokens on the tx network, which the hacker then exchanged for real coins from the vault. This is a classic example of an attack on trust in state validators, rather than on cryptographic protection.
The tx developers responded promptly: the bridge was halted, the vulnerable code was fixed, and independent blockchain experts were brought in for the investigation. All transaction data has been handed over to the FBI's Internet Crime Complaint Center. The team is currently considering compensation options for affected users. It is important to emphasize that funds in the mainnet, as well as on centralized and decentralized exchanges, were not affected.
Withdrawal details
According to data from the analytics service xrpl.to, the withdrawal process took 97 minutes. During this time, nearly 200,000 XRP ($199,916) was sent from the bridge address in 94 transactions to two new wallets. Only 493.5 XRP remained on the balance instead of the original ~200,410. Notably, each transaction was confirmed by 17 of the 28 relay keys — exactly the number required by the multisig rules. This indicates that the attacker either controlled a sufficient number of keys or found a way to bypass the confirmation threshold.
Key takeaway: the cybercriminal did not gain access to private keys, and the XRP Ledger itself functioned without any disruptions. This underscores that the vulnerability was specific to the tx bridge implementation, not the underlying protocol.
Parallel attack on Harmony
During the same period, the L1 blockchain Harmony was also attacked. An analyst under the pseudonym Juiceberg reported that the attacker used empty blocks to create 4 billion ONE tokens — this is 26% of the total supply. Of these, 2.8 billion were transferred to trading platforms. Amid the incident, the coin's price collapsed by nearly 30%. The Harmony team stated that they are working jointly with exchanges to freeze funds and are considering a network rollback.
This is already the second major hack for Harmony: in June 2022, the project lost $100 million through the Horizon bridge, and, according to the FBI and Elliptic, the North Korean hacker group Lazarus Group was behind that attack. The current incident once again raises questions about the security of cross-chain solutions.
These events occur against the backdrop of a series of other attacks: on August 10, the Coinsbuy platform was hacked ($8 million in damages), and earlier, attackers drained Lightning nodes through a vulnerability in BTCPay. It is obvious that hackers are actively targeting bridges and infrastructure solutions, where code complexity often exceeds its level of security.
My verdict: the tx incident is a wake-up call for the entire industry. Bridges remain the most vulnerable link in the DeFi ecosystem, and even multisig confirmations do not guarantee protection if the deposit validation logic is flawed. Projects need to conduct more thorough audits and implement real-time anomaly monitoring mechanisms, otherwise we will see new victims.