Coreum Bridge Loses 200,000 XRP in 97-Minute Attack: A Critical Verification Failure

How 200,000 XRP Vanished in Under Two Hours

Two days after becoming public, details emerged that the Coreum cross-chain bridge had suffered a devastating loss of approximately 200,000 XRP during a 97-minute window. Early theories circulating on social media pointed toward a vulnerability in the XRP Ledger’s rippling mechanism. However, according to an analytical report from xrpl.to, the actual culprit was far more mundane: the bridge had essentially sabotaged its own security by placing blind faith in unverified transactions from an attacker.

The Anatomy of a Self-Inflicted Breach

The exploit had nothing to do with XRP Ledger’s rippling function—native XRP contains no issuer or trust lines, making rippling technically impossible for the asset. The real vulnerability stemmed from incomplete verification logic in the bridge’s relayer system.

Every malicious transaction was authenticated using the bridge’s legitimate multisignature wallet, protected by a 17-of-28 quorum among relayer validators. The attacker never obtained access to these keys. Instead, they executed a more elegant attack: transferring wrapped-CORE tokens between wallets they controlled, while embedding fake deposit details in the transaction memo field.

As xrpl.to documented, the relayer operators performed only surface-level verification. They confirmed that a transfer had occurred and read the memo content, but never validated the critical detail—that the funds had actually reached the bridge’s wallet address. This missing check in the relayer code proved catastrophic. The system credited the attacker with a balance based entirely on their falsified deposit records. When the attacker subsequently requested a withdrawal, validators signed off on transferring 200,000 legitimate XRP from the bridge’s XRPL wallet without discovering the deception.

Institutional Negligence and Systemic Damage

The bridge’s development team carries a notable history of rebranding efforts. The group initially launched Sologenic (SOLO) on the XRP Ledger, later created Coreum as its own Layer 1 blockchain, and consolidated both operations under a U.S.-registered entity called TX in March 2026. The TX brand explicitly marketed itself as a regulated, institutional player specializing in real-world asset tokenization.

The breach inflicts reputational wounds that extend far beyond the stolen funds. This was not a random technical bug but evidence of inadequate quality control at a company presenting itself as institutional-grade and compliance-focused. A regulated U.S. firm overlooked a fundamental security principle: verification that deposits reached their intended destination before granting account credits. As of the incident’s public disclosure, the TX team had not published an official post-mortem report, and the Coreum bridge remained completely offline.

Blockchain trackers indicate the attacker is attempting to obscure their identity by routing the stolen XRP through a series of transit wallets established approximately 1.5 months before the attack commenced. The attacker’s identity remains unknown.

Cross-chain bridges represent critical infrastructure for the cryptocurrency ecosystem, and security lapses at institutional-level projects erode confidence in the sector’s foundational systems.

Source: xrpl.to, via U.Today. Not financial advice.