Cross-chain bridge tx attacked: hacker withdrew $200,000 in XRP and exposed a vulnerability in deposit logic
On August 9, 2026, a cross-chain bridge connecting the tx blockchain to the XRP Ledger was subjected to a targeted attack. The attacker drained the bridge's reserve wallet, stealing approximately $200,000 in XRP. The incident exposed a critical flaw in the deposit processing logic, which allowed the system to accept fictitious transactions as real incoming funds.
Mechanics of the hack: how the system was deceived
The essence of the exploit was that the bridge incorrectly processed incoming transactions that did not contain actual XRP. Based on these false records, the protocol issued "wrapped" tokens on the tx network. Using these tokens, the hacker was able to withdraw real coins from the bridge's reserve storage. It is important to emphasize that the attack did not affect funds in the mainnet, nor assets on centralized and decentralized exchanges.
According to data from the analytical service xrpl.to, the withdrawal took 97 minutes. During this time, nearly 200,000 XRP ($199,916) were sent from the bridge's address in 94 transactions to two new wallets. Only 493.5 XRP remained on the balance instead of the original approximately 200,410. Notably, each transaction was confirmed by 17 of the 28 relay keys—exactly the number required by the multisignature rules. This suggests that the attacker either compromised a sufficient number of keys or exploited a vulnerability in the confirmation logic.
Team response and security measures
After detecting suspicious activity, the tx team immediately halted the bridge's operation, removed the vulnerable code, and brought in blockchain experts for analysis. All transaction data was forwarded to the FBI's Internet Crime Complaint Center. Developers are currently considering compensation options for affected users. Analysts emphasize that the hacker did not gain access to private keys, and the XRP Ledger itself functioned without issues.
Parallel attack on Harmony
During the same period, the L1 blockchain Harmony was also attacked. The project team reported working with exchanges to freeze stolen funds and is considering network rollback options. An analyst under the pseudonym Juiceberg discovered that the attacker created 4 billion ONE tokens through empty blocks—this is 26% of the token's total supply. Of these, 2.8 billion were transferred to trading platforms, causing the coin's price to plummet by nearly 30%.
This is not the first hack of Harmony: in June 2022, the project lost $100 million as a result of an attack on the Horizon cross-chain bridge. CertiK specialists at the time pointed to the compromise of a multisig wallet, while analysts from Elliptic and the FBI attributed the hack to North Korean hackers from the Lazarus Group.
These incidents highlight a systemic security problem with cross-chain bridges. Errors in deposit verification logic remain a favorite target for attackers, and even with multisignature in place, finding a weak spot in the code is enough to bypass all defenses. In my view, the industry needs to reconsider bridge audit standards, paying special attention to the handling of non-standard transactions, rather than only testing standard scenarios.