200K XRP Drained in 97 Minutes as Coreum Bridge Exploited

200,000 XRP Drained in 97 Minutes as Bridge Flaw Exposes a Bigger Crypto Risk 

200,000 XRP was siphoned in just 97 minutes after a logic flaw in the Coreum–XRP Ledger bridge reportedly allowed an attacker to trigger withdrawals without stealing private keys or compromising the XRP Ledger itself.

According to market analyst Xaif Crypto, the attacker exploited a weakness in the bridge’s relayer logic. Rather than properly verifying the actual destination address, the system reportedly relied on transaction memo data, a seemingly minor flaw that could cause fraudulent transactions to be treated as legitimate deposits.

More notably, the attacker allegedly made 94 payments in roughly 97 minutes, prompting the bridge to release genuine XRP without ever taking control of users’ wallets.

Why does this distinction matter? Well, the XRP Ledger itself was not hacked. Its consensus mechanism and underlying cryptography continued to operate normally. The vulnerability was reportedly located in the software connecting Coreum to XRPL.

Bridge exploits can be especially damaging because they add another layer of infrastructure between blockchain networks. 

Relayers and verification systems must accurately confirm that deposits are legitimate before assets are released elsewhere. If that verification fails, attackers can potentially extract real funds even while the underlying blockchain remains secure.

Coreum Bridge Halted After 200K XRP Exploit as New Scams Target XRP Users 

The Coreum bridge has reportedly been halted, with a full investigation and incident report still pending. Further analysis could reveal exactly how the flaw was exploited and where the drained XRP was transferred.

Well, the Coreum incident comes amid a separate wave of XRP-related scams.

In South Korea, Seoul police reportedly arrested three suspects after dismantling a fake Flare Network XRP staking operation that allegedly defrauded 71 investors of 3.4 million XRP.

Unlike the Coreum case, the South Korean incident involved an alleged fraudulent investment scheme rather than a technical bridge exploit. Together, however, the cases highlight two very different risks facing XRP users: software vulnerabilities and social-engineering scams.

The XRP Ledger Foundation recently also warned users about a separate scam falsely claiming that Ripple is offering XRP rewards through wallet scans, underscoring how scammers continue to exploit trusted names within the XRP ecosystem.

For XRP holders, the Coreum incident carries a notable takeaway that the reported loss occurred at the bridge level, not because the XRP Ledger itself was compromised.

Ultimately, the Coreaum occurrence is another reminder that even when a blockchain remains secure, the applications, bridges and infrastructure built around it can create entirely new attack surfaces.