tx XRP Bridge Drained of Nearly $200,000 in XRP Exploit

The tx XRP bridge was exploited on August 9, draining nearly its entire reserve of $200,000 in XRP.

The attacker took advantage of a security flaw that allowed them to create fake proof of deposits, which the bridge's own records assumed were real. This enabled them to obtain bridged tokens without funding the vault, then send those tokens back through the bridge to pull out real XRP from the reserve.

The drain began at 19:16 UTC and lasted 97 minutes, flowing through 94 individual transactions. A clear majority of 17 of the bridge's 28 relayers approved every payout, as the system was designed to work. Relayers are programs that listen to both chains and clear a withdrawal if the bridge's records say there is one due.

tx has admitted that bridged XRP on its chain 'is not currently fully backed.' The company has disabled the bridge, fixed the security flaw in its code, hired blockchain forensic specialists, and filed a report with the FBI's Internet Crime Complaint Center. However, it has not specified how holders of unbacked bridged XRP will be reimbursed.