The tx project team has revealed details of a sophisticated attack on a cross-chain bridge connecting the XRP Ledger to its blockchain. The attacker discovered a critical vulnerability in the deposit-processing logic and stole $200,000 from the bridge’s reserve wallet on August 9, 2026.
Key fact: The hacker did not gain access to private keys and did not compromise the XRP Ledger. The vulnerability existed exclusively in the bridge smart contract logic, which treated empty transactions as real XRP deposits.
The attack was based on a fundamental error in the logic used to process incoming deposits. The cross-chain bridge treated transactions that did not actually contain XRP as real deposits. Based on these false records, the bridge automatically issued wrapped tokens on the tx network, which the hacker then used to withdraw real coins from the reserve.
The validation system checked whether a transaction existed on the XRP Ledger but did not verify whether that transaction actually transferred XRP. This made it possible to create "empty" transactions that passed validation without moving any real assets.
According to xrpl.to, the withdrawal process took just 97 minutes. During that time, the hacker executed a carefully planned sequence of transactions:
Important detail: Each payment was approved by 17 of 28 relayer keys — exactly the number required under the multisig rules. The system worked "as designed"; the underlying logic itself was flawed.
After detecting suspicious activity, the tx project team took a series of emergency measures:
The developers emphasized that the attack did not affect user funds on mainnet or on centralized and decentralized exchanges. The team is considering reimbursement options for affected users.
Almost simultaneously with the attack on the XRP bridge, the Harmony Layer-1 blockchain was also targeted by hackers. An analyst known as Juiceberg reported a critical incident:
Harmony team response: "We are working with our team and relevant exchanges to stop and freeze the funds. We are working on a patch and rollback options."
This is already Harmony’s second major hack — in June 2022, the project lost $100 million. At the time, analysts at Elliptic and the FBI concluded that North Korean hackers were behind the attack.
The vulnerability in the XRP bridge belongs to the class of input-validation flaws — one of the most common types of smart contract vulnerabilities.
Security paradox: The system behaved exactly as it had been programmed to behave. The problem was not a coding bug, but a design flaw — the bridge trusted the existence of a transaction more than its actual contents.
The incident contains critical lessons for the entire cross-chain protocol industry.
Users of cross-chain bridges should take additional precautions.
Incidents like the XRP bridge hack are accelerating the development of more secure cross-chain protocols.
The industry is moving toward standardized best practices:
| Vulnerability Type | Description | Difficulty |
|---|---|---|
| Logic flaw | Error in smart contract business logic | Medium |
| Key compromise | Theft of validator private keys | High |
| Reentrancy | Re-entering a function before its previous execution completes | Medium |
| Oracle manipulation | Manipulation of price oracles | Medium |
The XRP bridge and Harmony incidents are taking place against the backdrop of broader crypto-crime trends in 2026:
The $200,000 XRP cross-chain bridge hack and the parallel attack on Harmony serve as harsh reminders that security in the cryptocurrency ecosystem is never a finished task.
These incidents demonstrate several critical points:
Key takeaway: In a world where hackers are constantly improving their methods, defenses must evolve even faster. Security is not a state that can be permanently achieved, but a continuous process of adapting to evolving threats.
For the tx project team, the incident was a serious test. However, its rapid and transparent response demonstrates a mature approach to crisis management. For Harmony, this marks the second major incident in four years, raising questions about deeper security problems within the project.
For users, these incidents serve as a reminder of the need for vigilance and caution when interacting with cross-chain protocols. Diversification, due diligence, and understanding the risks are essential practices for anyone participating in the DeFi ecosystem.
“Security is not a product that can be purchased once, but a process that must be maintained continuously. In a world where threats evolve every day, our defenses must evolve even faster.”
— Bruce Schneier, renowned cryptography and security expert
