XRP Coreum Bridge Hack: $200K Stolen in Under Two Hours
A recent hack of the XRP Coreum bridge has left it holding only 493 XRP, down from its initial balance of over 200,000. The exploit occurred on August 9 and was carried out in just under two hours, with the attacker withdrawing 199,916 XRP worth approximately $200,000 across 94 transactions.
The hack did not involve stolen private keys but rather exploited a flaw in the relayer software that trusted transaction memos instead of verifying actual payment destinations. This vulnerability was shared among independent operators who ran the same flawed code, leading to a collapse of trust and allowing the attacker to push through fraudulent withdrawal requests.
TX, the company behind Coreum and Sologenic, confirmed the incident and admitted its software incorrectly registered transactions that never delivered any XRP as real deposits. As a result, bridged XRP on the tx chain is no longer fully backed, with TX conceding that tokens meant to represent a one-to-one XRP reserve are now only partially collateralized.
The incident has raised concerns about the security of cross-chain bridges and the importance of thorough stress-testing before real money flows through them. The episode also serves as a cautionary case study for the broader crypto industry, highlighting the need for robust verification logic to prevent similar attacks in the future.