Key Takeaways
- The XRPL-Coreum Bridge was reportedly drained of roughly 200,000 XRP, leaving its XRP balance at only about 493.5 XRP.
- Preliminary analysis points to a relayer-validation flaw involving forged deposit information, rather than stolen private keys or a compromise of the XRP Ledger itself.
- The incident puts fresh attention on cross-chain bridge security, particularly the off-chain software that interprets transactions before authorizing transfers.
The XRPL-Coreum Bridge has reportedly been drained of nearly its entire XRP balance after an attacker exploited its transaction-relaying process, reducing the bridge’s holdings from around 200,410 XRP to just 493.5 XRP.
Preliminary incident data indicates approximately 200,000 XRP was removed during a rapid sequence of unauthorized payments, with the attack reportedly unfolding in about 97 minutes.
The bridge has since been paused while the incident is investigated.
Importantly, available information does not indicate that the XRP Ledger itself was compromised or that the bridge’s private keys were stolen.
Instead, the attack appears to have targeted how information was interpreted by the software connecting XRPL and Coreum.
As of Aug. 12, an official detailed post-mortem explaining the exploit has not been publicly indexed, meaning the precise attack mechanics remain preliminary.
How the Coreum Bridge Works
The distinction matters because the Coreum bridge sits between two independent blockchains.
Coreum’s documentation describes the XRPL-Coreum Bridge as a system that connects a multisignature account on XRP Ledger to a smart contract on Coreum via 32 relayers.
Those relayers monitor events on both chains and trigger actions on the opposite network.
When XRP or another XRPL-native asset moves toward Coreum, a payment is sent to the bridge’s XRPL multisig account.
Relayers detect the transaction, extract the relevant information, and submit proof to the bridge contract, which can then mint a corresponding representation on Coreum.
That communication layer appears central to the latest incident.
Preliminary analysis indicates the attacker was able to submit transactions containing false deposit information or manipulated memos that the relayer software treated as legitimate deposits.
That allegedly resulted in the system authorizing withdrawals without the corresponding assets actually being deposited.
Reports indicate 94 payments were ultimately authorized before the bridge was stopped.
If confirmed, the weakness would be in bridge validation logic rather than XRP Ledger consensus.
Stolen XRP Reportedly Moved Across Chains
Onchain tracing indicates the stolen XRP was subsequently moved through THORChain, converted into assets on Ethereum, and later sent toward Tornado Cash.
That route can make recovery considerably more difficult by moving funds away from the network where the initial exploit occurred.
The use of THORChain does not, by itself, indicate that THORChain was exploited. Cross-chain protocols can be used simply as liquidity infrastructure once stolen assets have already been obtained.
The incident comes amid renewed scrutiny of bridge infrastructure. In July, at least three separate cross-chain protocols lost more than $35 million within roughly six hours, with security researchers identifying compromised permissions and validation weaknesses rather than failures of underlying blockchain cryptography.
Bigger Question Is Bridge Solvency
The immediate concern now extends beyond the roughly 200,000 XRP removed.
Because bridged tokens represent assets that are expected to be backed on another chain, a large reduction in the bridge’s reserves raises questions about whether outstanding Coreum-side representations remain fully collateralized.
Coreum’s own architecture states that the XRPL multisignature account holds assets supporting bridge transfers.
Until operators publish a full reconciliation of liabilities, remaining reserves, and any recovery plan, the key figure is therefore not simply the amount stolen.
It is the 493.5 XRP reportedly left behind, and whether that balance is sufficient to meet outstanding claims from users who have bridged XRP into the Coreum ecosystem.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
