According to Tx, the bridge underwent several internal and third-party audits before deployment, but the vulnerability was not identified.
XRPL, an independent XRP Ledger trading and analytics platform, found that the bridge released approximately 199,916 XRP through 94 payments over 97 minutes. Each payment was authorized by 17 of the bridge’s 28 relayers, programs that monitor both blockchains and approve transfers.
According to XRPL, the relayers mistook the attacker’s self-directed transactions for deposits. The attacker then withdrew the resulting unbacked balances through the bridge’s normal process.
The analysis rejected an initial claim that the XRP had been drained through “rippling,” an XRPL feature that moves issued tokens across trust lines. Native XRP cannot move through rippling, according to XRPL.
“A widely-shared warning blamed “rippling” and an on-by-default account flag. The ledger says otherwise: every one of those payments was signed by the bridge’s own multisig, and native XRP cannot be rippled at all,” XRPL wrote. “Reading both public chains together, the real cause is a relayer that mistook the attacker’s own self-payments for deposits.”
In a separate post on X, Reza Bashash, a principal at CoreNest Capital and co-founder of Sologenic and Coreum, said the attacker converted the stolen XRP to Ethereum, moved it onto the Ethereum network through THORChain, and sent the entire amount to crypto mixer Tornado Cash, making the funds significantly harder to trace.
Tx said it halted the bridge, fixed the affected code, traced the stolen funds, and filed a complaint with the FBI’s Internet Crime Complaint Center. It also hired blockchain forensics specialists and is working with security partners.
“As we pursue all legal paths forward, we are simultaneously evaluating all options for remedying the situation for affected users,” tx said.
The bridge remains offline while tx reviews its security. The project said holders do not need to take action and warned against accounts or websites claiming they can recover the funds.
The price of XRP hasn't budged much, despite the issues on the network. The Ripple-linked token continues to hover around the $1 mark, at roughly a $64 billion market cap, dropping roughly 5.5% over the last 30 days.
Traders on Myriad, a prediction market build by Decrypt's parent company, currently believe XRP continues to stay at the $1 price point for the rest of the week.
