A cross-chain bridge tx on XRP Ledger has been hacked: the hacker withdrew $200,000.
My team of analysts has recorded yet another serious breach in cross-chain interaction infrastructure. This time, the bridge connecting XRP Ledger to the tx blockchain came under attack. The incident occurred on August 9, and the attacker managed to completely drain the bridge's reserve wallet, stealing approximately $200,000 in XRP.
The essence of the attack lies in a critical flaw in the deposit processing logic. The bridge mistakenly accepted transactions without an actual XRP transfer as real incoming funds. Based on these fictitious records, the system generated "wrapped" tokens on the tx network, which the hacker then used to withdraw real coins from the vault. This is a classic data substitution maneuver, but executed with rare precision.
It is important to emphasize that the attack was targeted in nature and did not affect user funds on the mainnet, nor on centralized or decentralized exchanges. The tx developers responded promptly: the bridge was halted, the vulnerable code was identified and patched. Independent blockchain experts have been brought in for the investigation, and all transaction data has been handed over to the FBI's Internet Crime Complaint Center. The team is currently evaluating compensation options for those affected.
Exploitation Details
According to my data, the withdrawal of funds took 97 minutes. During this time, nearly 200,000 XRP (exact amount — $199,916) left the bridge address in 94 transactions, distributed across two new wallets. Only 493.5 XRP remained on the balance instead of the original ~200,410. Notably, each payment was confirmed by 17 of the 28 relay keys — exactly the number required by the multisig rules. This suggests that the attacker either found a way to bypass the threshold or operated within a legitimate process but with forged input data. The key point: the hacker did not gain access to private keys, and the XRP Ledger itself functioned without failures.
Parallel Strike on Harmony
During the same period, the L1 blockchain Harmony also came under attack. The project's team confirmed that, together with exchanges, it is freezing stolen funds and considering network rollback options. An analyst under the alias Juiceberg discovered that through empty blocks, the attacker generated 4 billion ONE — 26% of the token's total supply. Of these, 2.8 billion were transferred to trading platforms. The market reaction was swift: the price of ONE collapsed by nearly 30%.
This is not the first such case for Harmony. In June 2022, the project lost $100 million as a result of the Horizon bridge hack. At that time, CertiK specialists recorded the compromise of a multisig wallet, while analysts from Elliptic and the FBI attributed the attack to the North Korean Lazarus group. The current incident once again raises questions about the security of cross-chain bridges, which remain the most vulnerable link in the DeFi ecosystem.
My comment: Such attacks are a systemic problem, not a coincidence. Bridges are complex structures where every logical error can become an entry point for a hacker. Investors should reconsider their approach to storing assets on such protocols, and developers should implement multi-layered transaction authenticity checks rather than relying on standard confirmation mechanisms.