A cross-chain bridge linking the XRP Ledger to the tx blockchain (formerly Coreum) lost roughly 199,916 XRP, worth approximately $200,000, in just 97 minutes on August 9, 2026, after attackers exploited a flaw in how the bridge verified deposits. The incident didn't compromise either blockchain's core security or steal any private keys. Instead, it exposed a gap in the bridge's off-chain relayer software, the layer responsible for confirming that funds actually arrived before authorizing withdrawals on the other side. The exploit is small by recent crypto-hack standards, but it lands in a year when bridge exploits are piling up again, reviving a question the industry has struggled with since the Ronin Bridge lost $624 million in 2022: why does the connective tissue between blockchains keep breaking in the exact same way?

What Exactly Went Wrong in the tx Bridge Attack?

The tx bridge operates through a network of 17 relayers, off-chain software agents that watch one blockchain for deposits and then authorize matching releases on the other. Their job is straightforward: confirm that XRP actually arrived at the bridge's deposit address before approving any payout on the tx side. The attacker didn't need to defeat this check cryptographically. Instead, they exploited a gap in what the check actually verified.

By moving the bridge's own wrapped tokens between wallets they controlled and attaching memos formatted to look like real bridge deposits, the attacker got the relayer software to treat self-transfers as inbound XRP payments. The relayers, following their logic correctly but checking the wrong thing, signed off on real XRP withdrawals against deposits that had never happened. The flaw came down to a design oversight: the relayer logic checked transaction memos without verifying the actual destination address or confirming that funds had genuinely moved into the bridge's control.

The speed of the drain is what stands out to security researchers. Ninety-four payments in 97 minutes means the attacker was firing off a withdrawal roughly every 62 seconds, fast enough that automated monitoring, if it existed, either didn't fire an alert or fired one too late to matter. The bridge's reserve wallet fell from approximately 200,410 XRP to 493.5 XRP by 20:53 UTC on August 9, with the attacker beginning withdrawals at 19:16 UTC.

Why Do Bridges Keep Failing in the Same Ways?

Bridges have absorbed a disproportionate share of crypto's total hacking losses for years. Industry trackers put cumulative bridge-hack losses above $2.8 billion since 2022, accounting for roughly 69% of all funds stolen from decentralized finance (DeFi) protocols in that span. The pattern across nearly every major bridge exploit is remarkably consistent: bridges fail at their weakest trust component, whether that's a multisig (a wallet requiring multiple signatures to authorize transactions) with too few independent signers, a relayer that checks the wrong field, or a proof-verification routine that accepts a forged input.

The tx bridge incident joins a long, expensive list of bridge failures. The Ronin Bridge lost $624 million in March 2022 through compromised validator keys. The Poly Network lost $611 million in August 2021 due to a contract logic flaw. The BNB Bridge lost $568 million in October 2022 through fraudulent proof verification. Wormhole lost $326 million in February 2022 via a signature-verification bypass. Nomad lost $190 million in August 2022 when faulty initialization allowed copycat draining. Harmony Horizon lost $100 million in June 2022 through compromised multisig validator keys.

What makes the tx exploit particularly instructive is that it wasn't a cryptographic failure or a stolen key. It was a design flaw, the kind that unit tests catch far more reliably than a formal audit focused on smart-contract logic. The tx team confirmed that the bridge had gone through both internal and third-party audits before launch, yet the flaw wasn't caught.

How to Evaluate Bridge Security Before Trusting Your Funds

• Verify Deposit Logic: Ask whether the bridge checks transaction destination addresses and confirms funds actually landed in the bridge's control, not just whether transaction memos match an expected format.
• Understand Relayer Architecture: Know how many independent relayers sign off on withdrawals and whether they operate under a multisig structure that requires a threshold of signatures to authorize any payout.
• Review Testing Beyond Audits: Confirm that the bridge has undergone unit testing, integration testing, and stress testing for edge cases like self-transfers and memo-spoofing scenarios, not just formal audits of contract logic.
• Check Monitoring and Response: Verify that the bridge operator has automated monitoring systems in place to detect unusual withdrawal patterns and a documented incident-response plan that can execute faster than 97 minutes.
• Assess Post-Launch Support: Ensure the bridge team commits to ongoing maintenance, security updates, and forensic investigation if an exploit occurs, rather than treating launch as the end of responsibility.

The tx team's response included disabling the bridge, patching the verification code, bringing in blockchain forensics specialists, and filing a report with the Federal Bureau of Investigation's Internet Crime Complaint Center (IC3). However, the damage was already done.

The broader context matters here. Web3 security firm CertiK's Hack3D report tallied $1,315,676,432 stolen across 344 on-chain incidents in the first half of 2026 alone, making 2026 a record year for crypto theft. The tx bridge exploit, while small in dollar terms, is emblematic of a structural problem: bridges have to reconcile two different security models into one trust boundary, and that reconciliation layer remains the industry's most vulnerable point.

For developers and teams building blockchain infrastructure, the lesson is clear: deposit verification isn't just about checking memos or transaction IDs. It requires confirming the actual movement of funds into the bridge's custody, testing for edge cases that auditors might overlook, and maintaining monitoring systems that can respond faster than an attacker can drain a reserve. Until the industry treats bridge verification with the same rigor it applies to cryptographic primitives, bridges will remain crypto's persistent weak point.