An attacker drained 99.7% of the XRP reserve backing the Coreum cross-blockchain bridge on August 9 by conjuring fake evidence of deposits that fooled the bridge’s own operators into authorizing real withdrawals.
Nobody stole anyone’s private key to execute the clever hack. Instead, Coreum’s bridge liquidity account paid out 199,916 XRP worth over $200,000 across 94 transactions, each one carrying a majority of signatures from its own relayers.
Hours later, Coreum was shocked to discover it held just 493 XRP worth roughly $500.
A memo was all Coreum’s bridge required
The relayer software watched the bridge account’s history for payments carrying a Coreum recipient memo.
It never verified that payment destination. A seemingly valid memo existed, yet the destination was the hacker’s wallet.
Ostensibly independent operators reached identical conclusions and signed off on all of the withdrawals because they were all running the same buggy code.
Read more: XRP Ledger generated less than $400 in fees yesterday
TX confirms an FBI report
TX, a brand that absorbed both the Coreum and Sologenic communities in February, confirmed the incident, and admitted the software “incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits, and minted bridged XRP on the tx chain against them.”
The same statement said the bridge had undergone “multiple internal and third-party audits prior to deployment.”
It also conceded that bridged XRP on the tx chain “is not currently fully backed,” and confirmed a complaint had gone to the FBI.
The price of XRP dipped below $1 yesterday, its first sub-dollar print since November 2024. The coin has lost 45% of its value this year, and is 74% below its all-time high.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
