A crypto bridge lost nearly all of the 200,000 XRP it held in an attack that lasted 97 minutes, according to a report carried by Yahoo Finance. The figure and the duration are the two hard numbers in the incident, and both point to the same operational reality: once an attacker found the bridge's weakness, no control layer stopped the drain before the balance was effectively gone.

By Tom Whitfield

What happened?

The bridge held roughly 200,000 XRP. Over 97 minutes — an hour and a half plus change — the attacker extracted nearly the entire amount. The report does not name the protocol, the chain pair it connected, or the exact vulnerability class, so those details remain unverified until an on-chain tracing firm or the project itself publishes an attribution.

What the numbers do establish is the tempo of the failure. A 97-minute window means the drain was not instantaneous. Intermediate monitoring, withdrawal limits or manual circuit breakers either did not exist or did not trigger in time. That distinguishes this incident from single-transaction exploits and places it in the slower category, where detection tools had a real chance to intervene and did not.

Why bridges keep failing this way

Bridges concentrate risk by design. They lock assets on one chain and mint representations on another, which makes the locked pool a single point of failure with a readable balance. An attacker who finds a flaw in signature verification, message validation or validator sets can draw from that pool repeatedly until it empties.

At 200,000 XRP, this pool sits at the small end of bridge holdings — a scale at which teams often run lean security budgets and skip formal audits. The exploit size matters less as a headline than as a signal: attackers now target long-tail infrastructure where the cost of compromise is low and the defender's capacity to respond is lower.

What are the operational consequences?

For the protocol's operators, a near-total loss of locked funds typically forces one of three outcomes: a full halt of the bridge, a migration of remaining user positions to a rewritten contract, or an unwind of the minted representation tokens on the destination chain. Each path carries its own accounting problem, because liabilities on one side of the bridge no longer match assets on the other.

For users, the practical lesson repeats one the sector has heard since the large bridge failures of 2022 and 2023: funds locked in a bridge are exposed to that bridge's code and operations, not to the security of either underlying chain. A bridge connecting two otherwise robust networks inherits the weaknesses of its weakest component.

What comes next?

The unnamed status of the protocol will not last. On-chain forensics firms routinely de-anonymize exploits of this size within days, and exchanges that receive the drained XRP will face their own compliance decisions when the funds move through KYC'd accounts. Expect an attribution, a post-mortem or both before the incident fades from the incident trackers.

Readers should treat any figure beyond the 200,000 XRP loss and the 97-minute window — attacker wallets, vulnerability detail, reimbursement plans — as unconfirmed until the protocol or a tracing firm publishes verified on-chain evidence.