Direct answer: On August 9, 2026, an attacker drained 199,916.3 XRP (about $200,000, roughly 99.7% of the bridge's reserve) from the XRP Ledger–to–tx cross-chain bridge in 94 payments over 97 minutes. The XRP Ledger and its native asset were not compromised — every payout was correctly co-signed by the bridge's own multisignature relayer quorum. The actual failure sat in the bridge's deposit-verification logic on the tx (formerly Coreum) side: relayers accepted the attacker's self-transfers of the bridge's own wrapped token as if they were genuine XRP deposits, then authorized real XRP withdrawals against balances that were never funded. tx has halted the bridge, patched the flaw, hired forensics specialists, and filed an FBI complaint, but has not yet detailed compensation for affected holders.

Key takeaways

• 199,916.3 XRP left the bridge's XRPL reserve wallet in 94 payments between 19:16 and 20:53 UTC on August 9, 2026, dropping the balance from roughly 200,410 XRP to about 493.5 XRP.
• Every payout was authorized by 17 of the bridge's 28 relayer keys — the multisig worked exactly as designed. The XRP Ledger was not hacked and no private keys were stolen.
• The root cause was a deposit-verification gap in the bridge's relayer software: it recorded a wallet-to-wallet transfer of the bridge's own wrapped token as a real deposit because it never checked whether the payment was actually sent to the bridge.
• Coreum rebranded to tx in March 2026 after merging with Sologenic; the exploited bridge connects the XRP Ledger to the tx chain.
• tx (via its official account, @txEcosystem) confirmed the bridge is halted, the vulnerability is identified and patched, forensics specialists are engaged, and an FBI Internet Crime Complaint Center report has been filed. No compensation plan has been published as of this writing.
• This is a distinct incident from the August 9 Coinsbuy TRON/Ethereum exchange-wallet hack (covered separately by LiveVolatile) — different chain, different mechanism, same date coincidence only.

What happened, in plain terms

A cross-chain bridge is meant to work like an escrow vault with a ledger on the other side: a user locks XRP on the XRP Ledger, the bridge notices the deposit, and a matching amount of wrapped XRP is minted on the destination chain (tx, formerly Coreum). Reversing the process burns the wrapped token and releases real XRP from the vault.

On August 9, an attacker found a way to make the ledger say a deposit had happened when it hadn't. According to on-chain forensic analysis published by XRPL.to and corroborated by CoinDesk's reporting (which cites tx's own account of the incident), the attacker:

1. Created two new XRPL wallets in the hour before the attack (17:34 and 17:57 UTC).
2. Sent the bridge's own wrapped-token IOU between their two wallets — never to the bridge itself — while attaching a memo formatted to look like a legitimate bridge deposit tag.
3. Because the bridge issues that wrapped token, the self-transfer still touched the bridge's transaction history. The bridge's relayer software, which watches for deposit-tagged transactions but does not verify the destination address, misread the transfer as a real deposit.
4. Relayers submitted matching "evidence" attestations to the smart contract on the tx chain; once enough relayers agreed, the contract minted bridged balance to the attacker with no real XRP behind it.
5. The attacker started with small probe amounts, then scaled up, before converting the unbacked balance into real XRP withdrawals from the reserve wallet — 94 payments in total, alternating between the two wallets roughly every 51 seconds.

Critically, every one of those 94 payments was a properly signed multisignature transaction from the bridge's own account, with 17 of its 28 relayer keys co-signing — because the relayers' internal records genuinely showed the attacker was "owed" that XRP. The flaw was upstream of the signatures, in what counted as evidence of a deposit, not in the signing process itself or in the XRP Ledger.

Timeline of confirmed and reported events

How the exploit worked: the mechanism

The bridge's smart contract on the tx chain never reads the XRP Ledger directly. Instead, it relies entirely on relayers — operator programs that watch both chains — to submit "evidence" of deposits. Once enough relayers (a quorum) submit matching evidence for the same transaction, the contract trusts it and mints wrapped tokens.

NORMAL FLOW (how it should work)
User → locks XRP with bridge on XRPL
        │
        ▼
Relayers watch XRPL, confirm XRP actually reached
the bridge account, submit deposit evidence
        │
        ▼
Contract on tx mints wrapped XRP to the user

EXPLOITED FLOW (what actually happened)
Attacker → sends bridge's own wrapped token
            between their OWN two wallets
            (never touches the bridge's XRP)
        │
        ▼
Relayers see a bridge-memo'd transaction in the
bridge's history — but never check the DESTINATION
        │
        ▼
Relayers wrongly submit it as deposit evidence
        │
        ▼
Contract mints unbacked wrapped balance to attacker
        │
        ▼
Attacker redeems the unbacked balance →
bridge's relayer quorum (17-of-28) signs a REAL
XRP payout from the reserve wallet
        │
        ▼
Repeated 94 times over 97 minutes → reserve drops
from ~200,410 XRP to ~493.5 XRP

The design flaw, in short: the relayer code checked that a bridge-tagged transaction occurred, but not who it was sent to. Since the bridge issues the wrapped token, any movement of that token — even a private wallet-to-wallet transfer — shows up in the bridge's own transaction history and could be mistaken for a deposit if a memo is attached.

Bridge hacks in context: how this compares

Cross-chain bridges have been a recurring weak point across 2026, and this incident sits alongside other verified exploits LiveVolatile has tracked or that have been independently reported:

The dollar amount here is small relative to some 2026 bridge incidents, but the mechanism is unusually instructive: it is not a stolen-key story or a smart-contract reentrancy bug. It is a trust-boundary failure — the relayers trusted "a transaction with the right memo appeared in the bridge's history" as proof of payment, without confirming who actually paid whom. That is a pattern worth watching across other bridges that rely on memo-tagged deposit detection rather than strict address-matching.

Why this matters for volatility — and what to monitor

Bridge exploits are a recurring, underappreciated source of short-term crypto volatility because they combine three things markets react to quickly: a real loss of funds, uncertainty about scope (is this contained, or does it reveal a wider problem?), and knock-on effects on token liquidity and trust in wrapped-asset backing.

For XRP specifically, the immediate risk is narrow — the XRP Ledger itself was not compromised, and the loss (~$200,000) is small relative to XRP's market capitalization. The more relevant volatility questions are:

• Is bridged XRP on tx currently fully backed? As of this writing, tx has confirmed it is not, since the reserve was drained to about 493.5 XRP against outstanding wrapped balances. Any wrapped-XRP holders on tx should treat this as an active, unresolved risk until tx publishes a remediation or compensation plan.
• Will tx publish a compensation or backstop plan? The absence of one so far is itself a data point. A credible, funded plan would likely reduce uncertainty; a delayed or partial one could weigh on sentiment toward tx-issued assets and Coreum-legacy tokens.
• Do other bridges share the same "memo-based deposit detection without destination checks" pattern? This is the kind of design flaw that tends to get looked for elsewhere once publicized. Traders holding bridged assets on similar relayer-based bridges should watch for security disclosures in the days following.
• Onward movement of the stolen funds. CoinDesk reported the stolen XRP moved through several addresses within hours of the drain. Continued visible movement or an eventual freeze/recovery attempt (via exchanges or forensics firms) is a fact worth tracking, separate from speculation about who was responsible.

LiveVolatile users can track live XRP conditions and compare current volatility against historical baselines using the market analysis dashboard and the cryptocurrency volatility comparison tool, and should treat any renewed bridge-related headlines about XRP or tx-issued assets as a reason to check multi-venue liquidity and spreads before assuming a single data point reflects the wider market.

FAQ

Was the XRP Ledger hacked?

No. On-chain analysis confirms every payment that left the bridge's reserve wallet was a properly authorized multisignature transaction, signed by 17 of the bridge's 28 relayer keys. The XRP Ledger's protocol and consensus were not compromised; the flaw was in the bridge's own relayer software on the tx (Coreum) side.

How much was stolen, and how much is left in the bridge?

The attacker withdrew approximately 199,916.3 XRP (about $200,000) across 94 payments in 97 minutes, leaving the bridge reserve wallet with about 493.5 XRP — roughly 0.3% of its prior balance.

What caused the exploit?

The bridge's relayer software recorded a transaction as a deposit whenever it saw the bridge's memo attached and the bridge's own wrapped token involved, without verifying that the payment was actually sent to the bridge's reserve address. The attacker exploited that gap by moving the wrapped token between two wallets they controlled.

What has tx done since the exploit?

According to tx's own statement (posted via @txEcosystem on X and quoted by CoinDesk), tx has halted the bridge, identified and patched the vulnerable code, engaged blockchain forensics specialists, and filed a complaint with the FBI's Internet Crime Complaint Center. tx has not yet published a compensation plan for affected holders.

Is bridged XRP on the tx chain currently safe to hold?

As of this writing, tx has confirmed that bridged XRP on its chain is not fully backed by the reserve. Holders should treat this as an unresolved risk until tx publishes further remediation details, and should not assume backing has been restored without an official confirmation.

Is this the same incident as the Coinsbuy hack?

No. Both occurred on August 9, 2026, but they are unrelated: the Coinsbuy incident involved TRON and Ethereum exchange-linked wallets with an undisclosed attack vector, while this incident is a cross-chain bridge relayer flaw between the XRP Ledger and the tx chain. The date overlap is coincidental.

Conclusion

The tx (Coreum) XRP bridge exploit is a useful case study precisely because it wasn't a stolen key or a classic smart-contract bug — it was a trust-verification gap between what a relayer saw and what it should have confirmed. The XRP Ledger performed exactly as designed throughout; the bridge's own deposit-detection logic did not. tx's public halt, patch, and law-enforcement referral are the right immediate steps, but the absence of a compensation plan and confirmation that bridged XRP is not currently fully backed leave real uncertainty for holders of tx-side wrapped assets. Volatility-focused traders should separate the (contained, XRPL-side) headline shock from the (unresolved, tx-side) balance-sheet question, and watch for tx's next official update before assuming the incident is closed.

Risk disclaimer: Cryptoassets are volatile and carry risk of partial or total loss. This article is for educational and informational purposes only and does not constitute financial, investment, or trading advice. Verify current bridge status, compensation announcements, and market data independently before making decisions involving XRP or tx-issued assets.

Sources and image credits

• CoinDesk — "Ripple news: XRP bridge drained after software mistook fake deposits for real ones", published Aug. 12, 2026 — primary secondary reporting quoting tx's official statement.
• XRPL.to — "The Coreum Bridge Released 200,000 XRP. It Wasn't Rippling.", on-chain forensic analysis with transaction-level detail, dated Aug. 11, 2026.
• tx official website — confirms the March 2026 Coreum/Sologenic merger and rebrand to tx.
• Corroborating reports reviewed for cross-checking figures and status: KuCoin, CCN, CryptoRank.io, Protos, The Crypto Basic, Crypto Briefing, TechTimes, BeInCrypto, Yahoo Finance — all published Aug. 11–12, 2026 and consistent on the core figures (199,916 XRP, 97 minutes, 94 payments, 17-of-28 relayer signatures).
• Broader 2026 bridge-loss context: CryptoTimes, "Crypto Bridge Hacks Top $328M in 2026 as Cross-Chain Exploits Accelerate", May 18, 2026 — reported cumulative figure, included for context only.

Visual treatment: Original explanatory Markdown flow diagrams (normal vs. exploited bridge deposit flow) created for LiveVolatile from the verified on-chain sequence. No external image or screenshot reused.

— Marcus Reynolds, Senior Crypto Volatility Analyst