$XRP Bridge Drained of $200,000 in 97-Minute Attack

An $XRP bridge connected to Coreum's blockchain was drained of nearly $200,000 worth of XRP after an attacker exploited a software flaw that let them claim fake deposits and withdraw real tokens.

The bridge, which allows users to transfer XRP between the XRP Ledger and Coreum (formerly tx), was compromised on August 9. The attack began at 19:16 UTC and lasted for 97 minutes before the system was halted.

The attacker found a way to make the system issue receipts without putting any XRP into the vault, allowing them to withdraw real tokens from the reserve wallet. This was made possible by a missing check in the relayer code that processed payments carrying the bridge's memo without verifying the destination address.