The Tx network’s XRP Ledger bridge lost nearly 200,000 XRP worth approximately $202,000 on August 9, 2026. The attacker tricked the system by creating uncollateralized XRP balances within the Tx Chain network, then swapped them out for genuine XRP tokens.
According to a report from independent analytics platform XRPL, 199,916 XRP flowed out of the bridge reserves across 94 separate payments. The draining process occurred rapidly, taking just 97 minutes from the start of the first transaction.
Tx itself is a new Layer-1 ecosystem that launched to the public in March 2026. The network was built as a hybrid of the Coreum blockchain and the Sologenic tokenization platform. This hack once again proves that passing security checks is no absolute guarantee, given that the Tx bridge had actually undergone multiple internal and third-party audits prior to its full release.
Why Were a Dozen Relayers Fooled?
The root cause of the hack lies in the bridge’s deposit detection logic. The bridge system recorded a transaction as a valid XRP deposit when, in reality, no XRP was actually received by the system.
The attacker exploited this vulnerability by sending a self-directed transaction to their own wallet. This self-directed transaction triggered the bridge’s sensors and fooled 17 of the 28 relayers responsible for authorizing fund releases. The majority of these relayers assumed the attacker’s transaction was a new deposit, prompting them to greenlight the release of genuine XRP from the bridge vault to the hacker.
After pocketing hundreds of thousands of XRP tokens, the attacker wasted no time in laundering their tracks. They immediately converted the stolen XRP tokens into Ethereum, then moved them via the cross-chain protocol THORChain. All funds ultimately ended up in Tornado Cash, a crypto mixer service frequently used to sever on-chain tracking paths.
Initially, speculation emerged that the hacker exploited a native XRP Ledger feature called rippling to seize the funds. However, the team from the XRPL analytics platform quickly refuted this erroneous claim. They emphasized that pure XRP assets have absolutely no capacity to move through the rippling mechanism.
Remediation Steps and Market Impact
Responding to the exploit, the Tx development team took action by temporarily pausing bridge operations to patch the vulnerable codebase. In addition to patching the loophole, they also escalated the case by reporting it directly to the U.S. FBI’s Internet Crime Complaint Center (IC3), while hiring professional blockchain forensic experts to hunt down the perpetrator.
Meanwhile, news of the hundreds of thousands of dollars in lost assets left virtually no mark on XRP’s price movement in the crypto market. Ripple’s flagship cryptocurrency continued to trade stably around the $1 mark, with a market capitalization reaching $64 billion. Its price chart only showed a standard decline of about 5.5% over the past 30 days.
Compared to other crypto bridge hacks, the financial loss of the Tx bridge is indeed smaller. However, the incident highlights a recurring fatal weakness: if the most basic logic for recognizing incoming funds is flawed, the security walls of a dozen relayers and stacks of audit certificates will still collapse easily.
Reported by Decrypt.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
