- Coreum’s bridge lost nearly 200,000 XRP after a flaw let an attacker fake deposits.
- The attacker drained the funds in 97 minutes using 94 XRP withdrawal payments.
- The exploit shows how weak deposit checks can put cross-chain bridges at risk.
Nearly 200,000 XRP was stolen from Coreum’s cross-chain bridge on Aug. 9 after an attacker exploited a flaw in its deposit verification process.
The attacker drained 199,916 XRP in about 97 minutes, sending the funds to two newly created wallets. The breach left the bridge with just 493.5 XRP. The exploit allowed the attacker to trigger XRP withdrawals without making legitimate deposits.
How the Attacker Bypassed Checks
According to XRPL.io, the bridge released the stolen XRP through 94 separate payments. Each transaction received approval from 17 of the bridge’s 28 relayer keys, allowing the withdrawals to pass the bridge’s normal checks.
The attacker first moved wrapped Coreum tokens between wallets they controlled. They then added a memo designed to resemble a genuine bridge deposit.
Related: Crypto Hacks Hit $110 Million in July While Bug Discoveries Rise
The relayers checked whether the transactions succeeded, the amount being transferred and the recipient listed in the memo. But they did not verify whether the corresponding XRP had actually reached the bridge.
That allowed the attacker to create fake deposit signals that triggered real XRP withdrawals. The evidence also ruled out XRP Ledger’s DefaultRipple setting as the cause of the loss.
Bridge Security Risks Grow
Bridge exploits remain a major security risk for the crypto industry. Blockchain security platform Blockaid recorded 212 on-chain exploits during the first half of 2026, with losses exceeding $1.1 billion.
KelpDAO and AFX Trade have faced bridge attacks in recent months. Coreum’s case points to the same problem from a different angle. The attacker did not need to break the bridge outright. Instead, they found a weakness in the way it checked deposits and used it to get the system to release XRP.
Related: An AI Agent Exploits a Gym API, What Could Happen to Crypto Wallets?
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
Source: https://coinedition.com/coreum-bridge-breach-drains-199916-xrp-in-97-minute/
Be the first to comment