XRP Bridge Drained After Software Treats Fake Deposits as Real
A flaw that went undetected during multiple audits allowed an attacker to create unbacked balances and withdraw XRP from the bridge’s reserves.
An XRP bridge, connecting the XRP Ledger to Coreum, which rebranded as tx in March, was drained of nearly 200,000 XRP, worth about $200,000. The bridge's software flaw allowed an attacker to claim deposits that were never made, then withdraw real tokens against the fake balances.
The attacker created unbacked balances and withdrew XRP from the bridge's reserves, according to Decrypt. The drain began at 19:16 UTC on August 9 and was halted 97 minutes later.
The bridge worked like a vault with a receipt system, where a user sends XRP into a reserve wallet on the XRP Ledger, and the bridge creates an equivalent amount of bridged XRP on the other chain. However, the software registered transactions as deposits even though they never delivered XRP to the bridge, allowing the attacker to withdraw real XRP from the reserve, as reported by CoinDesk.
Brief written by urgent.news from Decrypt, CoinDesk — 2 reports on this story. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
