An XRP bridge lost $200,000 to fake deposits — how bridge hacks actually work

A bridge connecting the XRP Ledger to another blockchain called tx lost nearly 200,000 XRP — about $200,000 — on August 9, after an attacker tricked its software into accepting deposits that were never actually made. The project has halted the bridge, patched the flaw, and filed a complaint with the FBI, but has not yet said how affected users will be repaid.

To understand what went wrong, it helps to know what a bridge does. Blockchains can't talk to each other directly, so a bridge acts like a vault with a receipt system: you lock real tokens into a reserve on one chain, and the bridge issues you an equal amount of "bridged" tokens on the other chain. Hand those receipts back, and you can reclaim your original tokens from the vault.

The attacker found a way to get receipts without putting anything in the vault. Because of a software flaw, the bridge recorded transactions as deposits even though no XRP had actually arrived. That produced bridged XRP with nothing backing it, which the attacker then sent back through the bridge to withdraw real XRP from the reserve. The drain ran for about 97 minutes before the system was stopped.

What makes this instructive is that the bridge's safeguards worked exactly as designed — and still failed. Each withdrawal was approved by 17 of 28 "relayers," the programs that watch both chains and sign off on transfers. They approved because the bridge's own records told them the deposits were genuine. The real error sat a layer deeper, in code that processed the payments without properly verifying where the money was going.

Bridges are one of the most frequently exploited pieces of crypto, precisely because they hold large reserves and rely on complex code to decide what is "real." For a beginner, that doesn't mean bridges are always to be avoided, but it does mean treating them with extra care: prefer well-established, widely audited bridges, move small amounts first, and don't keep funds parked in a bridge longer than you need to. When a bridge is exploited, the stolen tokens usually move within hours, which is why recovery is rare.