Fake deposits emptied the tx bridge while 17 relayers signed every payout
On August 9 an attacker drained almost the entire reserve of XRP that supports the bridge between the XRP Ledger and the tx blockchain. The take was about 199,916 XRP, or about $200,000.
This leaves the bridged XRP that tx users have without the real tokens they are supposed to redeem it for. The operator has closed the bridge, and the FBI has been alerted.
Fake deposits emptied the reserve in 97 minutes
The attacker fed the bridge fake proof of deposits that never happened. The bridge’s own records assumed that the proof was real.
The bridge locks actual XRP in a reserve wallet on the XRP Ledger and mints an equivalent amount of bridged XRP on the partner chain. Returning the bridged tokens should release the genuine ones.
This loophole allowed the attacker to obtain the bridged tokens without funding the vault, then send those tokens back through the bridge to pull real XRP out of the reserve.
tx confirmed in its own update that its software “incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits” and minted bridged XRP against those phantom deposits.
… Continue reading the full article at the original source below.
