A cross-chain bridge that once held over 200,000 XRP was left with pocket change in less than two hours, and nobody had to steal a single private key to make it happen. The XRP Coreum bridge hack drained 99.7% of the reserve backing the Coreum-to-XRP Ledger connector on August 9, turning what should have been routine deposit verification into an open door for an attacker who simply understood the software better than the people running it.
Summary
Key takeaways
- An attacker drained 99.7% of the XRP reserve backing the Coreum cross-blockchain bridge on August 9, leaving it holding roughly 493 XRP.
- 199,916 XRP, worth more than $200,000, was withdrawn across 94 transactions in a window of about 97 minutes.
- The exploit did not involve stolen private keys; it exploited buggy relayer software that trusted a transaction memo instead of verifying the actual payment destination.
- TX, the brand behind Coreum and Sologenic, confirmed the incident, admitted bridged XRP on its chain is not currently fully backed, and said a complaint has been filed with the FBI.
- XRP fell below $1 for the first time since November 2024 as the news spread, though the coin’s broader slide this year predates the exploit.
The Exploit That Emptied Coreum’s Bridge
The Coreum bridge lost virtually its entire XRP reserve in a single, tightly compressed attack window. Coreum’s The bridge liquidity account disbursed 199,916 XRP, valued at approximately $200,000, through 94 separate transactions, and each payout carried a majority of valid signatures from the bridge’s own relayer network. Within hours, the project discovered it held just 493 XRP, down from a balance that had sat around 200,410 XRP before the attack began.
According to on-chain analysis, the withdrawals were executed in roughly 97 minutes, between 19:16 and 20:53 UTC. That speed mattered: it gave the attacker a narrow but sufficient runway to push dozens of fraudulent withdrawal requests through the bridge’s multisig approval process before anyone noticed the reserve was disappearing.
This wasn’t a breach of the XRP Ledger itself. No validator was compromised, and no wallet had its keys stolen. The damage came entirely from a flaw in third-party bridge infrastructure sitting on top of the ledger, a distinction that matters when assessing how far the fallout could spread.
How the Relayer Software Was Fooled
The mechanics behind the Coreum XRP exploit reveal a surprisingly simple gap in the bridge’s design. The relayer software was built to scan the bridge account’s transaction history for payments carrying a specific Coreum recipient memo, treating that memo as proof that a deposit had genuinely arrived. What it never did was confirm that the payment had actually reached the correct destination wallet.
The attacker took advantage of that gap by moving self-controlled wrapped tokens between wallets they owned, attaching a Coreum-formatted memo to each transfer. Because those wrapped tokens had originally been issued by the bridge itself, the transactions showed up cleanly in its history, with nothing to flag them as fake deposits. The relayer logic checked the memo field and little else, ignoring the recipient address that would have exposed the deception.
That blind spot fed directly into how the withdrawals got approved. Authorization required 17 of 28 relayer keys to sign off, and every one of those independent operators was running the same flawed code. Because each node evaluated the same falsified evidence and reached the same wrong conclusion, the bridge’s decentralized safeguard collapsed into a single point of failure. This is the core lesson of the bridged XRP vulnerability: distributing trust across many operators offers little protection if they’re all trusting the same broken verification logic.
TX Confirms the Breach and Calls in the FBI
TX, the brand that folded both the Coreum and Sologenic communities into a single ecosystem in February, confirmed the incident publicly and did not minimize what went wrong. The company admitted its software “incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits, and minted bridged XRP on the tx chain against them.”
That admission carries a direct financial consequence: TX conceded that bridged XRP circulating on the tx chain “is not currently fully backed” following the exploit, meaning tokens meant to represent a one-to-one XRP reserve are now only partially collateralized. The same statement noted the bridge had gone through “multiple internal and third-party audits prior to deployment,” a detail that raises uncomfortable questions about how a flaw this fundamental slipped through review. TX also confirmed that a formal complaint over the hack has been filed with the FBI, and the bridge remained suspended in the days following the breach while the team worked through its response.
Why this matters beyond Coreum itself: audited bridge software failing on a verification step this basic suggests the problem may sit less in code complexity and more in how thoroughly cross-chain systems get stress-tested before real money flows through them. For any project offering bridged assets, that’s a warning worth reading closely.
Market Fallout as XRP Slips Below $1
The timing of the exploit landed awkwardly for XRP’s broader price trend. The token dipped below $1 in the days following the hack, its first sub-dollar print since November 2024. XRP has now lost 45% of its value this year and sits 74% below its all-time high, a decline that had been building well before the bridge incident but that the exploit news did nothing to ease.
The episode also lands as a cautionary case study for a crypto bridge security breach more broadly. Cross-chain bridges depend on relayers or validators attesting that something genuinely happened on another network, and when that attestation logic has a bug, the entire trust model built on top of it gives way. Because this failure sat in third-party bridge infrastructure rather than the XRP Ledger’s core protocol, the direct damage to the wider XRP ecosystem may prove contained. But confidence in wrapped and bridged versions of XRP, and in similar relayer-based designs elsewhere, is a different matter, one that will likely depend on whether TX can show it has closed the gap for good.
FAQ
How did the attacker manage to withdraw XRP without stealing private keys?
The attacker exploited buggy relayer software that validated deposits based only on recipient memos without verifying the actual payment destination, tricking the system into treating fabricated deposits as real.
Why did independent operators approve the fraudulent withdrawals?
The operators ran the same vulnerable software, which accepted fake deposit evidence at face value. Because every relayer relied on identical flawed logic, they reached the same wrong conclusion and signed off on withdrawals that were never legitimate.
What has been the official response from Coreum and TX regarding the exploit?
TX confirmed the incident, admitted the software incorrectly recorded transactions that never actually delivered XRP as real deposits, and disclosed that bridged XRP on the tx chain is not currently fully backed as a result.
What legal actions have been taken following the hack?
A complaint regarding the hack has been filed with the FBI, according to TX’s statement confirming the incident.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
