Nearly 200,000 XRP worth approximately $202,000 flowed out of the Tx project’s XRP Ledger bridge on August 9, 2026. The attacker breached the system not through a complex hack, but by manipulating the bridge software to read empty transactions as genuine deposits.
XRPL analytics platforms recorded that the bridge released a total of 199,916 XRP. This process occurred through 94 installments over 97 minutes. Each payment received full authorization from 17 out of 28 relayers tasked with securing this cross-chain bridge.
How Relayers Were Fooled
The vulnerability stemmed from a software error in reading the flow of funds. The bridge system recorded the attacker’s self-directed transaction as an incoming XRP deposit, even though no coins were actually deposited there. Armed with this fake deposit, the attacker minted unbacked XRP on Tx Chain, then swapped it back through the bridge to withdraw real XRP.
Speculation initially circulated that the exploit leveraged a vulnerability in the built-in “rippling” feature of XRPL. However, investigations confirmed that the issue was purely due to relayers mistakenly recognizing the attacker’s transaction as an incoming deposit. Reza Bashash, head of CoreNest Capital and co-founder of Sologenic and Coreum, confirmed the flow of these stolen funds.
This case serves as a warning for cross-chain infrastructure developers. Tx itself is a layer-1 ecosystem launched in March 2026 from the merger of the Coreum and Sologenic blockchains. Prior to its public release, the Tx bridge had undergone multiple rounds of internal and third-party audits. Ironically, this fundamental deposit-reading logic flaw slipped past the auditors’ eyes.
Flight to Tornado Cash
After obtaining hundreds of thousands of native XRP, the attacker immediately maneuvered to erase their tracks. They swapped the XRP for Ethereum, then moved it to the Ethereum network using the THORChain protocol. This escape route culminated in a final destination often favored by hackers: all stolen funds were deposited into Tornado Cash.
In response to the exploit, Tx has suspended all bridge operations and begun patching their flawed code. The company is now hiring blockchain forensics specialists to track the remaining movement of funds, while also reporting the theft incident to the FBI’s Internet Crime Complaint Center.
On public exchanges, the $202,000 theft had virtually no impact on price action. XRP remained stable around $1, with a market capitalization reaching $64 billion. The asset recorded a slight decline of about 5.5% over the last 30 days, but that trend is not directly related to the Tx bridge incident.
Multi-layered audits evidently were not enough to secure the cross-network gateway. When the gatekeeper system cannot distinguish between actual incoming funds and illusory transactions, dozens of approval locks become meaningless.
Reported from Decrypt.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
