XRP Bridge Drained After Bug Accepts Fake Deposits
An undetected software flaw allowed an attacker to fake deposits and drain real XRP reserves—despite multiple security audits.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- A flaw in an XRP bridge allowed an attacker to trick the system with fake deposits.
- The hacker generated unbacked balances and withdrew reserves from the bridge.
- The bug went completely undetected through multiple security audits.
Someone just cleaned out an XRP bridge by tricking its code into accepting ghost deposits as real cash.
A flaw in the software let the attacker print unbacked balances out of thin air. Once the system logged those fake numbers, the thief simply walked away with the real XRP sitting in the bridge's reserves. The kicker? The bug went completely unnoticed despite going through multiple security audits.
Audits Aren't a Guarantee
Bridges rely on tight code logic to make sure tokens deposited on one side match what gets issued on the other. Here, that verification logic failed completely. The smart contracts couldn't spot the difference between actual tokens and phantom entries, opening the door for a total drain of the bridge's reserves. It's a stark reminder that even audited code can carry fatal blind spots.
Why it matters
If you move assets across protocols, here's your reality check: clean audit reports don't make smart contracts bulletproof. Cross-chain bridges remain prime targets for hackers because they lock up massive amounts of liquidity. When audit teams miss basic balance verification errors, users are the ones left holding the risk.
Source: Decrypt
Top Crypto Casinos Right Now
🇦🇺 Showing sites that accept players from Australia Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-oriented casino that turns away only New Jersey. The cashier takes crypto, but the site publishes fewer specifics than any operator we list.
- KYC
- Required
Restricted countries: New Jersey (US).
More info Less info
Why we chose it: One of the widest crypto line-ups of any book we list - seven coins with fast payouts - aimed squarely at Asia and Latin America rather than the US or Western Europe.
- Licence
- Curacao
Restricted countries: United States, United Kingdom, France, Spain, Italy, Germany, Austria, Sweden and 20 more.
More info Less info
Why we chose it: Built for American bettors, priced accordingly. Biggest welcome bonus of the five, attached to the heaviest rollover of the five.
- Online since
- 1994
- Licence
- Curaçao
- Payout time
- 24–48 hours (crypto)
- Wagering
- 18x sportsbook / 30x casino
- KYC
- Required
Restricted countries: Belgium, Costa Rica, Croatia, Curaçao, Aruba, Sint Maarten, Caribbean Netherlands, France and 11 more.
Alex Rivera
Alex covers crypto markets and trading, testing every platform hands-on before writing about it.
