Coreum Bridge Loses 200k XRP Due to Phantom Deposit Flaw

A recent incident on the Coreum-XRPL bridge has shed light on a previously unknown class of risk in cross-chain systems. The bridge lost nearly 200,000 XRP after an attacker exploited the transaction-verification logic without stealing validator keys or compromising the XRP Ledger itself.

According to on-chain analysis by XRPL.to, the attacker made transactions between wallets they controlled and attached the memo format expected by the bridge. Relayers detected these transactions as legitimate deposits even though no actual funds were transferred into the bridge.

The relayers' flawed verification logic allowed the attacker to create unbacked bridge balances representing roughly 200,001 XRP alongside millions of CORE tokens. The attacker could then withdraw the artificially created balance through the bridge's normal process.