Coreum Bridge Drained of 199,916 XRP ($200K) as XRP Slips Below $1

An attacker siphoned 199,916 XRP — worth roughly $200,000 — out of the Coreum cross-chain bridge on August 9, leaving the liquidity pool with just 493 XRP, or about $500. That is a 99.7% drawdown of the bridge’s entire reserve, executed not by stealing private keys but by tricking the bridge’s own relayer software into approving withdrawals that were never backed by real deposits.

The incident lands at a fragile moment for XRP, which broke below $1 for the first time since November 2024 and is now trading near $1.01. The token is down 45% year-to-date and sits 74% below its all-time high, underscoring how sentiment around the asset has soured well before this exploit surfaced.

How the exploit worked

The Coreum bridge’s relayer software was designed to scan the bridge’s transaction history for payments carrying a specific Coreum recipient memo, then treat any matching transaction as a valid deposit. The flaw: the code never confirmed that XRP had actually landed in the bridge account before minting equivalent bridged XRP on the other side.

The attacker exploited that gap by attaching a valid-looking memo to transactions that routed funds to a personal wallet instead of the bridge. Because every relayer ran identical, unaudited-for-this-flaw code, they all independently — and wrongly — signed off on the withdrawals, producing 94 separate transactions that carried majority relayer approval despite draining the pool.

TX confirms breach, files FBI complaint

TX, the brand that absorbed both the Coreum and Sologenic communities in February, confirmed the incident and acknowledged that its software “incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits, and minted bridged XRP on the tx chain against them.” The company said the bridge had gone through “multiple internal and third-party audits prior to deployment,” but conceded that bridged XRP on the tx chain “is not currently fully backed.”

TX said it has filed a complaint with the FBI over the theft. No details on remediation timelines, reserve replenishment, or compensation for affected users have been disclosed publicly.

Why the numbers matter

A $200,000 exploit is small in absolute terms next to XRP’s multi-billion-dollar market capitalization, but the 99.7% depletion ratio is the figure that matters for anyone holding bridged XRP on the tx chain: the tokens they hold are now only fractionally backed by real reserves until TX restores the pool. That is a direct, quantifiable counterparty risk that didn’t exist before August 9.

The exploit also adds to a running tally of bridge failures in 2026 — a year in which cross-chain bridges have already lost hundreds of millions of dollars to similar verification gaps, according to industry tracking of hack totals. For XRP holders, the timing compounds an already bearish technical picture, with the token’s break below the $1 psychological level occurring the day before this exploit came to light, adding another data point traders are weighing as capital rotates between XRP and other assets.

Read more: National Bank of Canada Discloses XRP, Bitcoin ETF Stakes as Grayscale Trust Halves

Sources

• cryptonews.com
• protos.com