- The bridge account held 200,409.87 XRP immediately before the first payment and holds 493.54 XRP now, ledger records show.
- Every payment was sent by the bridge account itself, carrying 17 signatures from a signer list of 28 relayer keys.
- tx halted the bridge and says it has identified the vulnerability; co-founder Reza Bashash attributes it to a relayer bug combined with the XRP Ledger’s DefaultRipple feature.
An attacker emptied the XRP Ledger account behind tx’s cross-chain bridge on 9 August, moving nearly 200,000 XRP to two wallets over 97 minutes and leaving the account with 493.54 XRP.
Ledger records put the account, rxXXXeMX8Gy5YvibvGLnQJ1XKKD7UswM1, at 200,409.878544 XRP immediately before the first payment in ledger 106,183,346, which closed at 19:16:42 UTC.
The last payment landed in ledger 106,184,842, closed at 20:53:50 UTC. XRPL.to counted 94 payments across that window, split between two wallets which took roughly 107,397.5 XRP and 92,518.8 XRP.
Both were created the same afternoon, at 17:34 UTC and 17:57 UTC, less than two hours before the first payment went out, and the account alternated between them roughly every 51 seconds. Each holds 2.999993 XRP today.
Read more: Trump, Truth Social Sued Over $100K Fast-Track Access
Signed by the Bridge Itself
Each payment carries the bridge account as the sender, with an empty signing key and 17 signatures attached. The account’s signer list holds 28 keys and sets a quorum of 17, and its master key is disabled, leaving the multisignature quorum as the only way it can move anything.
The sequence opened with a payment of the bridge’s own wrapped token, coreum7c8eb29e07, worth 91.965 units, and closed with 520.3 XRP. The two destination wallets forwarded almost everything they received within hours. The bridge account has signed one transaction since, a small wrapped-token payment the following morning.
tx, the ecosystem formed from Coreum and Sologenic, said on 11 August that the bridge was exploited and XRP drained from its reserve wallet, that the bridge has been halted, that the vulnerability has been identified and that all potential remedies are being evaluated.
Reza Bashash, co-founder of tx, attributed the exploit to a bug in the XRPL relayer logic combined with the XRP Ledger’s DefaultRipple feature, and said the attacker constructed cross-currency payments that the relayer read as incoming deposits.
Bridge failures have proved expensive to unwind. Kelp DAO lost US$293 million (AU$416.1 million) in April, US$220 million (AU$312.4 million) of it laundered beyond practical tracing, with about US$71 million (AU$100.8 million) frozen. That protocol moved its rsETH token onto Chainlink CCIP afterwards.
Read also: Goldman Sachs Buys NEOS Investments in $2.25B Deal for Instant Crypto ETF Foothold
Hackers,XRP,XRPL#XRP #Bridge #Exploit #Drains #Real #XRP1786697768
