Overview
- Operators say the bridge’s reserve lost roughly 198,700–199,900 XRP after an attacker exploited the system on Aug. 9 and completed 94 multisigned withdrawals in a 97‑minute window.
- The attacker created unbacked bridged XRP by submitting transactions that never delivered XRP to the reserve; relayer software treated those records as valid deposits because it did not verify the payment destination.
- Each outbound XRP payment carried the bridge’s multisig approval with 17 of 28 relayer signatures, and investigators see no evidence that relayer private keys or the XRPL protocol itself were compromised.
- Tx has halted the bridge, patched the deposit‑validation code, hired blockchain forensics partners, filed an IC3 complaint with the FBI, and says the stolen funds were converted to ETH then routed through THORChain into Tornado Cash; a small discrepancy in reported totals remains under review.
- The incident highlights a recurring risk for cross‑chain bridges that rely on off‑chain relayers rather than cryptographic proofs, and it underlines how rapid conversion into mixers can sharply reduce chances of recovering stolen assets.