Coreum Bridge Loses 200k XRP as Attackers Exploit Verification Blind Spot

The Coreum cross-chain bridge suffered a significant loss when approximately 200,000 XRP tokens went missing during a 97-minute attack. Initial speculation suggested that the incident was linked to a vulnerability in the XRP Ledger's 'rippling' function.

However, an analysis by xrpl.to revealed that the attacker effectively exploited a blind spot in the bridge's verification logic. The hacker moved their own wrapped tokens between wallets they controlled, with a memo containing transfer details for Coreum attached to these transactions.

The relayer operators only checked whether a transfer had occurred and what was written in the memo field, ignoring the recipient address. As a result, the bridge accepted the fake deposits and credited the hacker with a balance on its network.

The attacker then requested a regular withdrawal, which the validators signed without hesitation. This resulted in 200,000 real XRP being sent from the bridge's XRPL wallet to the hacker.