Coreum XRPL bridge loses nearly 200,000 XRP in relayer logic exploit

On August 9, 2026, an attacker exploited a relayer logic flaw in the Coreum cross-chain bridge, draining 199,916 XRP (valued at nearly the bridge's entire 200,410 XRP balance) in under two hours. The exploit did not compromise the XRP Ledger or private keys; instead, the bridge's relayer code failed to verify transaction destination addresses. This allowed the attacker to spoof deposits using wrapped tokens and trigger 94 legitimate multisig-approved withdrawals. The bridge remains suspended while the stolen funds are being moved through transit wallets.

Coreum XRPL bridge exploit

• ▪The Coreum bridge exploit did not involve a consensus failure of the XRP Ledger or a compromise of the bridge's private keys.
• ▪The Coreum bridge balance dropped from approximately 200,410 XRP to 493.5 XRP during the 97-minute attack window between 19:16 UTC and 20:53 UTC.
• ▪The Coreum cross-chain bridge connecting to the XRP Ledger was exploited on August 9, 2026, losing approximately 199,916 XRP in under two hours.

Relayer verification logic flaw

• ▪The Coreum bridge's multisignature authorization required a quorum of 17 out of 28 relayer keys to sign off on each outgoing XRP payout.
• ▪The Coreum bridge's relayer code processed payments without verifying whether the destination address of the transaction matched the bridge's own wallet address.
• ▪Initial social media theories attributing the Coreum bridge exploit to the XRP Ledger's "rippling" function were contradicted by XRPL documentation and transaction analysis.

Phantom deposit attack mechanics

• ▪The attacker moved the Coreum bridge's own wrapped tokens between self-controlled wallets with a memo formatted for the bridge, making the transfers appear in the bridge's transaction history.
• ▪The attacker executed 94 multisig-authorized withdrawal transactions to drain the real XRP from the Coreum bridge's XRP Ledger wallet.
• ▪The Coreum bridge relayers mistook the attacker's wallet-to-wallet wrapped token transfers for real deposits, crediting the attacker with unbacked balances on the Coreum network.

Stolen XRP fund movement

• ▪The attacker rapidly distributed the stolen XRP through a chain of transit wallets, including two staging accounts created on June 28, 2026.
• ▪On-chain analysis traced approximately 169,000 stolen XRP into two staging accounts and another 34,000 XRP moving toward three other wallets.

Bridge suspension status

• ▪The Coreum bridge's technical specification allows any relayer operator or the contract owner to halt operations, but only the owner can resume them.
• ▪The Coreum bridge originally launched on March 20, 2024, to connect the XRP Ledger to over 110 Inter-Blockchain Communication (IBC) compatible chains in the Cosmos ecosystem.
• ▪The Coreum cross-chain bridge remained completely suspended as of August 11, 2026, with no official post-mortem report published by the TX team or Coreum Development Foundation.

Cross-chain security vulnerabilities

• ▪The Coreum bridge exploit highlights a broader security vulnerability where cross-chain systems fail if their off-chain verification mechanisms accept incorrect information, even when the underlying blockchains remain secure.
• ▪The TX team, which operates the Coreum bridge, previously created the Sologenic (SOLO) project and merged both ecosystems under the U.S. brand TX in March 2026.