TX Chain XRPL Bridge Hacked for Nearly $200,000 in XRP

A significant security breach occurred on August 9 when nearly 200,000 XRP were stolen from TX Chain's bridge connecting the platform to the XRP Ledger. The attacker exploited a flaw in the deposit-detection logic of the bridge, allowing transactions sent elsewhere to be registered as valid bridge deposits.

The vulnerability involved the XRPL relayer logic and the ledger's DefaultRipple feature. The attacker created cross-currency XRPL payments that were detected as incoming bridge transfers, even though those payments went to other XRP Ledger addresses instead of the bridge vault.

As a result, unbacked XRP was minted on TX Chain, which the attacker later exchanged for real XRP held in the bridge reserve. The stolen XRP was converted into ETH and transferred through THORChain before being sent to Tornado Cash, making further tracking more difficult.