XRP bridge drained for $200,000 after software mistook fake deposits for real ones

An XRP bridge suffered a loss of nearly 200,000 XRP, valued at around $200,000, following a software error that allowed an attacker to claim nonexistent deposits and subsequently withdraw real tokens without proper backing. This bridge connected the XRP Ledger to the Coreum blockchain, a U.S.-based company that specializes in tokenizing real-world assets. On August 9, $200,000 worth of XRP disappeared from the bridge's reserve wallet within 97 minutes before the system was halted.

In a bridge, users send XRP to a reserve wallet on the XRP Ledger, and in return, the bridge creates an equivalent amount of bridged XRP on the other chain. When the holder wants to withdraw their real XRP, it is taken from the reserve. However, the attacker discovered a way to generate receipts without depositing any XRP into the vault.

The bridge's software erroneously registered transactions as deposits even when they didn't deliver the required XRP to the bridge, enabling the attacker to obtain bridged XRP on the tx chain without matching real XRP.

These unsecured tokens then returned through the bridge, and the attacker withdrew the corresponding real XRP from the reserve. The attack commenced at 19:16 UTC. Each withdrawal was authorized by 17 out of the 28 relayers, who approved transactions based on the bridge's records indicating that the deposits were legitimate. Relayers are software programs that monitor both blockchains and approve transfers when the bridge's records confirm that a withdrawal is due.

The vulnerability was identified in an update by tx, which confirmed that the attacker exploited software that incorrectly recognized transactions carrying no XRP to the reserve. The bridge has since been halted, and the vulnerability has been addressed. However, details regarding how affected holders will be compensated are yet to be disclosed.

The stolen XRP was promptly moved across several addresses within hours, raising concerns over the ease with which funds can be transferred following such breaches. Meanwhile, the company has engaged blockchain forensics specialists and reported the incident to the FBI's Internet Crime Complaint Center.