An attacker needed just 97 minutes to empty a cross-chain bridge linking the XRP Ledger to the tx blockchain (formerly Coreum), draining roughly 199,916 XRP, worth about $200,000 at the time, through 94 back-to-back withdrawals. The exploit, disclosed on August 9, 2026, didn’t touch the XRP Ledger itself or crack a single private key. It hit something more mundane and, security researchers say, far more common: the software that decides whether a deposit is real.
The incident is small by crypto-hack standards. But it lands in a year when bridge exploits are again piling up, and it revives a question the industry has been asking since Ronin lost $624 million in 2022: why does the connective tissue between blockchains keep breaking in the exact same way?
What Happened: The August 9 tx Bridge Exploit
The bridge in question moves XRP between the XRP Ledger and tx, the blockchain that Coreum rebranded into after merging with Sologenic, an XRPL-based tokenization platform, in March 2026. Before the attack, the bridge’s reserve wallet held about 200,410 XRP. By 20:53 UTC on August 9, it held 493.5 XRP, according to on-chain data cited by SlowMist and multiple crypto news outlets tracking the incident.
Blockchain analysis shows the attacker started pulling funds at 19:16 UTC, sending 94 separate payments out of the reserve wallet to two freshly created addresses. The whole drain wrapped up in under two hours, a pace that outran any manual intervention the tx team could have mounted once the pattern became visible.
The tx team said in a public statement that its bridge software had mistakenly registered transactions that never actually delivered any XRP to the bridge as legitimate deposits, then minted or released bridged XRP against those phantom deposits. The team also said the bridge had gone through both internal and third-party audits before launch, and the flaw wasn’t caught. tx disabled the bridge, began patching the verification code, brought in blockchain forensics specialists, and filed a report with the FBI’s Internet Crime Complaint Center (IC3).
Anatomy of the Attack: How Fake Deposits Fooled the Relayers
Cross-chain bridges like this one typically run on a network of relayers, off-chain software agents that watch one chain for deposits and then authorize a matching release on the other chain. In this case, 17 relayers were responsible for signing off on withdrawals from the bridge’s XRP reserve, according to reporting from Cryptopolitan. The relayers’ job was to confirm that XRP had genuinely arrived at the bridge’s deposit address before approving any payout on the tx side.
The attacker didn’t need to defeat that check cryptographically. They exploited a gap in what the check actually verified. By moving the bridge’s own wrapped tokens between wallets they controlled and attaching memos formatted to look like real bridge deposits, they got the relayer software to treat self-transfers as inbound XRP payments. The relayers, following their logic correctly but checking the wrong thing, signed off on real XRP withdrawals against deposits that had never happened.
The Missing Verification Step
Illustratively, the difference between a safe deposit check and the flawed one comes down to what gets confirmed on-chain before a payout fires:
// Flawed logic (illustrative): trusts memo formatting, not the actual transfer
function verifyDeposit(tx) {
if (tx.memo.matches(DEPOSIT_FORMAT)) {
return true; // never checks destination address or asset origin
}
return false;
}
// Safer pattern: confirm funds actually landed at the bridge's own address
function verifyDeposit(tx) {
if (tx.destination !== BRIDGE_RESERVE_ADDRESS) return false;
if (tx.asset !== EXPECTED_ASSET) return false;
if (tx.amount <= 0) return false;
return confirmations(tx) >= REQUIRED_CONFIRMATIONS;
}SlowMist’s incident write-up frames it plainly: the relayer logic checked transaction memos without verifying the actual destination address or that funds had genuinely moved into the bridge’s control. That’s a design flaw, not a cryptographic one, and it’s precisely the kind of bug that unit tests catch far more reliably than a formal audit focused on smart-contract logic.
Timeline: 97 Minutes That Emptied the Reserve
The speed of the drain is what stands out to researchers who reviewed the on-chain trail. Ninety-four payments in 97 minutes means the attacker was firing off a withdrawal roughly every 62 seconds, fast enough that automated monitoring, if it existed, either didn’t fire an alert or fired one too late to matter.
| Time (UTC), Aug 9, 2026 | Event | Bridge reserve balance |
|---|---|---|
| Before attack | Bridge holds full XRP reserve backing bridged assets | ~200,410 XRP |
| 19:16 | First fraudulent withdrawal authorized via fake-deposit memo | Draining begins |
| 19:16–20:53 | 94 total payments sent to two attacker-controlled wallets | Falling in real time |
| 20:53 | Final withdrawal completes; reserve nearly exhausted | ~493.5 XRP |
| Post-incident (Aug 9–12) | Bridge halted; tx team confirms root cause, hires forensics, files FBI IC3 report | 0 (bridge offline) |
Total losses landed at roughly 199,916.3 XRP, or about $200,000 to $202,000 depending on which hour’s price snapshot a given outlet used, since XRP was trading close to $1.00 that week. That’s a small dollar figure next to headline-grabbing bridge hacks, but the mechanism is the story here, not the size of the payout.
Why This Wasn’t a Blockchain Hack
It’s worth being precise about what broke and what didn’t. The XRP Ledger’s consensus protocol was never touched. No private keys were stolen or brute-forced. Users holding XRP in ordinary non-custodial wallets, or in US spot XRP ETFs, were unaffected. The exposure sat entirely inside the bridge’s off-chain relayer software, the layer that has to trust its own accounting before it moves funds across two otherwise unrelated ledgers.
That distinction matters because it’s the same distinction that has defined nearly every major bridge hack of the last four years. The base chains stay intact. The bridge, which has to reconcile two different security models into one trust boundary, is where things fail.
Cross-Chain Bridges: Crypto’s Persistent Weak Point
Bridges have absorbed a disproportionate share of crypto’s total hacking losses for years. Industry trackers put cumulative bridge-hack losses above $2.8 billion since 2022, accounting for roughly 69% of all funds stolen from DeFi protocols in that span. The August 9 exploit adds a comparatively small entry to a long, expensive list.
| Bridge | Date | Amount lost | Root cause |
|---|---|---|---|
| Ronin Bridge (Axie Infinity) | March 23, 2022 | $624 million | Compromised validator keys (5 of 9 multisig) |
| Poly Network | August 10, 2021 | $611 million | Contract logic flaw (largely recovered) |
| BNB Bridge / Token Hub | October 6, 2022 | $568 million | Fraudulent proof verification, forged mint |
| Wormhole | February 2, 2022 | $326 million | Signature-verification bypass on Solana side |
| Nomad | August 1, 2022 | $190 million | Faulty initialization allowed copycat draining |
| Harmony Horizon | June 23, 2022 | $100 million | Compromised multisig validator keys |
| tx / Coreum XRPL Bridge | August 9, 2026 | ~$200,000 | Relayer deposit-verification logic flaw |
The pattern across nearly every row in that table is the same: bridges fail at their weakest trust component, whether that’s a multisig with too few independent signers, a relayer that checks the wrong field, or a proof-verification routine that accepts a forged input. A ChainScore Labs review of bridge architecture put it bluntly, noting that a bridge’s security is only as strong as its weakest component, often a multisig, a relayer, or an oracle network, rather than the cryptography of either connected chain.
2026’s Bigger Picture: A Record Year for Crypto Theft
The tx bridge exploit didn’t happen in isolation. Web3 security firm CertiK’s Hack3D report tallied $1,315,676,432 stolen across 344 on-chain incidents in the first half of 2026 alone, already closing in on full-year 2025’s total. Chainalysis put 2025’s full-year crypto theft at roughly $3.4 billion. July 2026 alone saw about 30 major hacking incidents with combined losses near $210.3 million, per PeckShield monitoring data, a 177% jump from June’s $75.87 million.
| Period | Total losses | Source |
|---|---|---|
| 2022 (full year) | $3.8 billion | Chainalysis |
| 2023 (full year) | $1.7 billion | Chainalysis |
| 2024 (full year) | $2.2 billion | Chainalysis |
| 2025 (full year) | $3.4 billion | Chainalysis |
| H1 2026 | $1.32 billion (344 incidents) | CertiK Hack3D |
| June 2026 | $75.87 million | PeckShield |
| July 2026 | $210.3 million (~30 incidents) | PeckShield |
That backdrop included the Coldcard hardware-wallet exploit in late July, where attackers drained more than $100 million from thousands of wallets whose seed phrases had been generated with weak entropy, a separate but related reminder that crypto’s weakest links are rarely the base-layer chains themselves. Shattered.io covered that incident in detail in its hardware wallet security breakdown published after the exploit.
Market Reaction: XRP Price and the tx Token
XRP itself barely moved on the news. The token traded around $0.9998 to $1.01 through mid-August 2026, holding the $1.00 support level it had defended for most of the year after sliding roughly 43% off its January 2026 peak of $2.41. The muted reaction underscores that traders correctly read the exploit as a bridge-layer failure rather than a threat to the XRP Ledger or to XRP holders who never touched the bridge.
The tx token itself is harder to price cleanly because of the ongoing rebrand. Market trackers showed conflicting snapshots in the days after the exploit: CoinStats listed tx near $0.006266 with a market cap around $27.2 million, while CoinMarketCap’s legacy Coreum listing showed $0.02020 and a $7.77 million market cap. The split reflects the messy transition from Coreum to tx following the Sologenic merger, rather than a single clean market verdict on the exploit.
Industry Reaction
Coverage of the exploit spread quickly across crypto-native channels once the drain was confirmed. CoinDesk summarized the core mechanism for a broad audience: “ALERT: Nearly 200,000 $XRP drained from the Coreum cross-chain bridge, exploiting a flaw in the bridge’s deposit verification to create fake balances and trigger real withdrawals,” the outlet posted.
XRP-focused accounts moved just as fast to pin down the timeline. “JUST IN: 200,000 XRP drained from the Coreum-XRPL bridge in 94 payments over 97 minutes on Aug 9. Root cause: a relayer logic flaw,” BankXRP wrote as on-chain analysts reconstructed the attack.
On LinkedIn, security researcher Radoslav Krehlik summarized the incident for a technical audience, noting that “nearly 200,000 XRP was drained from the Coreum-XRPL bridge on August 9 in a rapid exploit,” in a post that walked through the fake-deposit mechanism for developers evaluating similar bridge designs.
Competitive Comparison: How Different Bridges Handle Trust
Not every bridge design carries the same risk profile, and the tx incident is a useful lens for comparing them. Multisig-and-relayer bridges, the model tx used, rely on a set of off-chain signers who watch one chain and authorize actions on another. That’s fast and cheap to build, but every relayer or validator added to the set is a potential point of failure, and the verification logic itself, as this incident shows, can be wrong even when the keys are never touched.
Light-client bridges, by contrast, have the destination chain directly verify cryptographic proofs from the source chain rather than trusting a relayer’s word for it. They’re harder to build and more gas-intensive, but they remove the “trust the messenger” problem entirely. Optimistic bridges sit in between, assuming transactions are valid unless someone submits a fraud proof within a challenge window, trading speed for a delay that gives watchers time to catch fraud before funds settle. MPC (multi-party computation) bridges split signing authority across many parties so no single relayer or small multisig can authorize a payout alone, addressing the exact failure mode a small relayer set enables.
None of these models is hack-proof, as the $2.8 billion in cumulative bridge losses since 2022 makes clear. But the tx exploit is a textbook case for why the industry keeps pushing toward light-client and MPC designs: the failure here wasn’t a broken signature scheme, it was software that never actually asked the right question before moving money.
Historical Context: A Decade of Bridge Failures
Cross-chain bridges have been a target since the 2021 DeFi boom made moving assets between chains a mainstream need. Poly Network’s $611 million loss in August 2021, though largely returned by the attacker in an unusual twist, set the template: a contract or verification flaw, not a cryptographic break, drains a shared pool of assets in minutes. 2022 turned out to be the worst year on record for bridge security, with Wormhole, Ronin, Harmony, Nomad, and BNB Bridge all suffering nine-figure losses within an eight-month stretch, pushing that year’s total crypto theft to roughly $3.8 billion according to Chainalysis.
Losses eased somewhat in 2023 and 2024 as bridge operators adopted stronger multisig thresholds, formal verification, and, in some cases, moved to light-client architectures. But 2025’s $3.4 billion total and 2026’s already-record H1 figure suggest attackers have simply moved down-market, hitting smaller and mid-sized bridges, exchanges, and wallets rather than the handful of billion-dollar targets that dominated 2022’s headlines. The tx exploit, at roughly $200,000, fits that shift: smaller, faster, and easier to execute against a bridge that had passed formal audits but still shipped a logic gap those audits didn’t catch.
What This Means for Bridge Users and Developers
For everyday XRP holders, the practical takeaway is narrow: funds held in self-custody wallets or on regulated exchanges were never at risk, and the exploit only affected assets actively deposited into this specific bridge. For developers building or auditing bridge infrastructure, the lesson is wider. Formal audits tend to focus on smart-contract logic and cryptographic assumptions; they’re less reliable at catching a relayer that trusts a memo field instead of confirming an actual on-chain transfer. That’s a gap between what audits are designed to find and what actually breaks in production.
Teams running similar relayer-based bridges should treat this as a prompt to re-verify that deposit confirmation logic checks destination address, asset type, and amount against the actual chain state, not just a formatted message. Real-time anomaly detection matters too: a bridge losing 40% of its reserve in under an hour is the kind of pattern that automated circuit breakers, not manual review, need to catch.
Predictions: Where Bridge Security Goes From Here
- More mid-size bridges get targeted, not fewer. With H1 2026 already at $1.32 billion in losses across 344 incidents, expect attackers to keep favoring smaller, less-monitored bridges over the handful of billion-dollar targets that defined 2022.
- Light-client and MPC adoption accelerates. Relayer-based designs will face growing pressure to either add cryptographic proof verification or split signing authority across more independent parties.
- Automated circuit breakers become a baseline expectation. A 97-minute, 94-transaction drain is exactly the kind of pattern that rate-limiting and anomaly detection could catch mid-attack; expect more bridges to add hard withdrawal caps per time window.
- Regulators lean harder on bridge operators after incidents. The tx team’s decision to file with the FBI’s IC3 signals bridges are increasingly treated as financial infrastructure subject to the same incident-reporting expectations as exchanges.
- Audit scope expands to include off-chain relayer code. Expect security firms to market “full-stack” bridge audits that explicitly cover relayer and off-chain verification logic, not just on-chain contracts, as a direct response to incidents like this one.
Related Coverage
- Hardware Wallet Security: 12 Steps After $100M Hack
- Seed Phrase Security: 12 Steps to an Offline Backup
- WEF Cybersecurity Outlook 2026: Fraud Tops CEO Fears
- Luna Moth: $20M Ransom, 100+ Law Firm Attacks
- TeamPCP Hacks GitHub: 3,800 Repos Stolen in 18 Minutes
Frequently Asked Questions
What exactly was hacked in the tx/Coreum bridge exploit?
Attackers exploited the deposit-verification logic in the relayer software of a cross-chain bridge connecting the XRP Ledger to the tx blockchain (formerly Coreum). They did not compromise the XRP Ledger, any private keys, or the tx blockchain’s core protocol.
How much XRP was stolen?
Roughly 199,916.3 XRP, worth approximately $200,000 to $202,000 at the time, was drained from the bridge’s reserve wallet through 94 payments between 19:16 and 20:53 UTC on August 9, 2026.
Is my XRP safe if I hold it in a regular wallet?
Yes. XRP held in standard non-custodial wallets, on exchanges, or in US spot XRP ETFs was not affected. The exploit was limited to funds that had been deposited into this specific bridge.
What is Coreum/tx, and why did it rebrand?
Coreum was an XRPL-adjacent smart contract blockchain that rebranded to tx in March 2026 after merging with Sologenic, an XRPL-based tokenization platform. The bridge in question connects the XRP Ledger to this tx network.
Has the bridge been fixed?
The tx team disabled the bridge immediately after detecting the exploit, said it is patching the deposit-verification logic, hired blockchain forensics specialists, and filed a report with the FBI’s Internet Crime Complaint Center (IC3). As of mid-August 2026, the team had not publicly detailed a reimbursement plan for affected users.
How does this compare to other bridge hacks like Ronin or Wormhole?
It’s far smaller in dollar terms (about $200,000 versus $624 million for Ronin or $326 million for Wormhole) but shares the same root pattern: a flaw in off-chain trust logic, not a break in the underlying blockchain’s cryptography.
Why do cross-chain bridges keep getting hacked?
Bridges have to reconcile the security assumptions of two separate blockchains through off-chain components like relayers, multisigs, or oracle networks. Each of those components is a potential single point of failure, which is why bridge exploits account for more than $2.8 billion, or roughly 69% of DeFi losses, since 2022.
Did the exploit affect the XRP price?
Barely. XRP traded around $1.00 through mid-August 2026, holding the support level it had defended most of the year. The muted reaction reflects the market’s read that this was a bridge-layer, not chain-layer, failure.
