According to Cryptopolitan, an attacker drained roughly 199,916 XRP—approximately $200,000—from the bridge's reserve wallet over a 97-minute window, leaving the liquidity account with 493 XRP and reducing backing to 0.3% of its prior balance. The breach warrants attention from anyone engineering or consuming cross-chain middleware, because the failure mode was not exotic: it was a missing field-level check that allowed phantom deposits to propagate through 17 of 28 relayers as if they had settled on the source ledger.
Anatomy of a phantom-deposit exploit
The bridge operates on a lock-and-mint model: genuine XRP is held in a reserve wallet on the XRP Ledger, and an equivalent quantity of bridged XRP is issued on the tx chain against verified deposits. Redemption reverses the flow. In normal operation, the relayer set—a cluster of programs listening to both chains—reads incoming payments to the bridge account and, if the on-ledger record corroborates the deposit, authorizes the mint on the partner chain. The relayer code, as described in the incident report, scans for payments tagged with a tx recipient memo but performs no verification of the payment destination. A memo string matching the expected format was sufficient to trigger state advancement, regardless of whether the payment had been routed to the attacker's own address or to the bridge vault itself. The relayer mesh therefore registered 94 sequential transactions as legitimate deposits within a single state-transition epoch beginning at 19:16 UTC, and minted bridged XRP against each one. Because the minted tokens were immediately returned through the withdrawal path, the reserve paid out real XRP into the attacker's control—17 independent relayers signing off on each step, each executing the identical buggy predicate.
Why audits missed it, and why this class persists
tx confirmed that the bridge had cleared multiple internal and third-party audits prior to deployment without surfacing the deposit-destination discrepancy. This is consistent with a recurring structural blind spot in bridge verification: the audit surface tends to cover cryptographic proof generation and consensus quorum logic, while the auxiliary data fields—memos, destination tags, off-chain metadata—receive lighter formal scrutiny. The same vulnerability taxonomy surfaced in the 2022 Wormhole and Nomad incidents, and most recently in the May Verus–Ethereum bridge exploit, where a forged Merkle proof yielded approximately $11.5 million; security firm Blockaid attributed that event to the same family of input-validation failures. Across 2026, bridge-related losses have accumulated to over $328 million across eight major incidents, per Cryptopolitan's tally—a figure that places cross-chain infrastructure among the higher-blast-radius components of the decentralized stack.
What to monitor
The bridge has been halted, the code-level fix deployed, and forensic specialists engaged, with a referral filed to the FBI's Internet Crime Complaint Center. tx has not yet disclosed a reimbursement framework for holders of unbacked bridged XRP, and the operational status of the bridge remains "closed" pending evaluation of remedies. On the market side, XRP traded at $1.01 at the time of writing, down 69% year-to-date, having briefly breached $0.9905 on August 11—the first sub-dollar print since November 2024. For developers building against cross-chain messaging, the relevant lesson is architectural rather than incident-specific: any relayer quorum is only as deterministic as its weakest parsing rule, and deposit-finality checks that depend on tag presence rather than ledger-confirmed value transfer will continue to be systematically exploitable until treated as first-class state-transition guards. The protocol's viability post-patch hinges entirely on whether the fix is scoped to this memo-parsing path or extended across every auxiliary input the relayer mesh consumes.