XRP Bridge Hacked for 200K in Fake Deposit Exploit

An attacker exploited the Coreum bridge connecting the XRP Ledger and tx by tricking its deposit-checking system, draining nearly 200,000 XRP on August 9.

The attack involved sending a fake deposit to the bridge's own wrapped token between two of the attacker's wallets, attaching a memo that made it appear as a genuine deposit. The relayers approved it, minted assets on the tx side, and the attacker withdrew real XRP against them.

Reza Bashash explained that the vulnerability was due to the bridge's software incorrectly registering transactions that never actually delivered any XRP to the bridge.

The tx team has halted the bridge and filed a report with the FBI's Internet Crime Complaint Center. A plan for compensating users is still being worked out, and no other bridged assets were affected.