Fake deposit exploit drains 200K XRP from tx bridge
A “fake deposit” exploit drained nearly 200,000 XRP from a bridge connecting the XRP Ledger and Coreum (rebranded as tx) on Aug 9. The attacker tricked the bridge’s deposit-checking logic into treating a wallet-to-wallet transfer as a real deposit.
The bridge was halted after the incident. Coreum-side software was identified as the root cause: the attacker sent the bridge’s own wrapped token between their wallets and attached a bridge-deposit memo. Because the token is issued by the bridge, relayers accepted the transaction and minted unbacked assets on the Coreum side, allowing withdrawals of real XRP on the XRPL.
Investigations put the stolen amount at about 198,715.88 XRP. On-chain flow reported in the article: XRP was converted to ETH, routed through THORChain, and finally sent to Tornado Cash. The tx team said a vulnerability was identified, and it filed a report with the FBI’s IC3. No other bridged assets were affected, and compensation plans are under discussion.
Traders first raised alarms after seeing a bridge-controlled XRPL account’s balance drop rapidly. Later analysis showed 21 separate Coreum relayers attested to the same “phantom deposit,” including valid multisig signatures on payouts, which helped confirm the “fake deposit” mechanism.
Market context: XRP was already under pressure, trading near ~$1.02 (around a 21-month low), down roughly 4.4% on the week as BTC fell toward ~$64,000 and broader crypto prices weakened.
Bearish
This is bearish because it highlights a bridge contract/deposit-validation failure that enabled minting unbacked assets—exactly the kind of event that can trigger immediate risk-off behavior among bridge users and liquidity providers. Similar past bridge incidents (when relayers or bridge-side accounting failed) often lead to short-term outflows from affected ecosystems, wider distrust toward cross-chain assets, and temporary volatility even if the hack is later contained.
Short-term impact: traders may price in “bridge risk premium.” The bridge being halted and the explicit mention of “fake deposit” exploitation can pressure XRP-related sentiment and reduce willingness to use the affected route.
Long-term impact: repeated evidence that validator/relayer attestations can be abused (21 relayers confirming a phantom deposit) raises questions about operational and software review across bridge infrastructure. That can slow integrations and increase audit/compliance costs, but it may also drive faster patching and clearer compensation frameworks, which could stabilize once details are confirmed.
Given XRP was already near a multi-month low, the additional negative catalyst increases downside pressure and raises the probability of elevated volatility around XRP and any assets routed through the same liquidity/bridge graph (e.g., ETH pathways).