XRP bridge exploit drains nearly $200k

TLDR

An XRP bridge was exploited for nearly 200,000 XRP (about $200,000), using fake deposits to drain the bridges reserves without attacking the XRP Ledger itself.

1. An attacker abused the Tx/Coreum XRP bridges deposit logic on 9 Aug, draining around 200,000 XRP and leaving the bridge with roughly 493 XRP in reserve.
2. The failure was in the bridges off-chain software, which misread self-directed transactions as real deposits, so the multisig relayers signed unbacked payouts.
3. The bridge is paused, Tx has involved law enforcement and is weighing compensation, while users face solvency and trust questions around bridged XRP and cross-chain bridges generally.

Deep Dive

1. Exploit Scale And Timeline

Multiple reports say an attacker drained nearly 200,000 XRP (about $202,000) from the Tx XRPL bridge on 9 Aug, via 94 payments over roughly 97 minutes, leaving only about 493.5 XRP on the bridge. This matches incident summaries of the XRPLCoreum bridge showing reserves cut from around 200,410 XRP to under 500 XRP after the attack.

The exploit was relatively small versus XRPs multibillion-dollar market cap, but large relative to the bridges own pool, effectively emptying it.

Confidence: high because independent news outlets and on-chain analyses report consistent figures and mechanics.

2. What Actually Broke

According to Txs incident explanation and follow-up reporting, the attacker did not compromise XRP Ledger consensus or steal private keys. Instead, they crafted transactions that never delivered real XRP but that the bridges off-chain deposit-detection logic falsely treated as valid deposits on the XRP side.

Relayer nodes then signed withdrawals based on these fake deposits, minting or releasing bridged XRP on the Tx/Coreum side and redeeming real XRP from the bridge reserve. Some analyses note that auditors had previously reviewed the bridge, but this specific logic flaw was not caught, underscoring that audits reduce but do not eliminate risk.

3. User Impact And XRP Risk

Tx halted the bridge, patched the code, traced flows across Ethereum and THORChain, filed a complaint with the FBI, and is evaluating how to compensate affected users. Until there is a clear recovery or make-good plan, holders of bridged XRP on the connected chains face uncertainty about whether their tokens remain fully backed.

Market reaction so far has been limited but visible: XRP briefly dipped below $1 and now trades near that level, with analysts noting the bridge exploit as an overhang on sentiment alongside already bearish technicals and thin volume. The incident also feeds broader skepticism about cross-chain bridges, which have been frequent targets in 2026.

Conclusion

This exploit did not break XRP Ledger itself, but it drained almost all XRP from a key bridge by exploiting deposit-detection software, putting bridged assets and user trust at risk. For XRP holders and bridge users, the practical takeaway is to treat bridges as separate risk systems, watch for solvency and compensation updates from Tx, and recognize that bridge logic, not just base-chain security, can drive both loss events and market sentiment.