Bridge Exploited, Nearly 200,000 XRP Stolen Through Fake Deposit Scheme
A bridge connecting the XRP Ledger and Coreum, now rebranded as tx, was exploited on August 9, resulting in the loss of nearly 200,000 XRP. An attacker successfully tricked the system into recognizing a wallet-to-wallet transfer as a legitimate deposit, leading to the theft.
The bridge has since been halted. Investigations by the operator and external researchers indicate the failure originated in Coreum-side software, with no issues identified on the XRP Ledger itself.
Initial Warnings and Exploitation Details
The first public alert came from a trader known as playa, who observed that the bridge’s XRP Ledger account was rapidly losing funds. Playa initially pointed to the account’s DefaultRipple setting as the potential cause. According to playa’s observations, the balance dropped from 93,700 XRP to 77,200 XRP within minutes, part of a larger, ninety-seven-minute drain.
Another user, Vet, clarified in the same discussion thread that the Coreum bridge was actively being exploited. Playa later acknowledged a rushed initial assessment.
The tx team confirmed the exploit, stating that its software “incorrectly registered transactions that never actually delivered any XRP to the bridge.”
Technical Breakdown of the Attack
Reza Bashash provided a technical explanation of the attack mechanism. The attacker sent the bridge’s own wrapped token between two of their wallets, appending a bridge-deposit memo. Because the token was issued by the bridge, the transfer appeared in the bridge’s transaction history and was mistakenly treated as a genuine deposit.
Relayers then approved these transactions, leading to the minting of unbacked assets on the Coreum side. The attacker subsequently withdrew real XRP against these fabricated assets. Bashash estimated the total stolen XRP at 198,715.88, which was then converted to ETH, routed through THORChain, and ultimately sent to Tornado Cash.
Remediation and Market Impact
The tx team has identified the vulnerability, and the bridge remains offline. A report has been filed with the FBI’s Internet Crime Complaint Center. No other bridged assets were affected by the incident. The operator is currently developing a plan to compensate affected users.
A subsequent on-chain review revealed the same root cause from a different perspective: 21 separate Coreum relayers independently attested to the same fraudulent deposit. This allowed the attacker to mint unbacked bridge assets and repeatedly execute the scheme with increasing amounts before cashing out. Each payout on the XRP Ledger was validated by a multisignature from the bridge’s relayer quorum, explaining why the initial DefaultRipple theory proved insufficient once transaction data was scrutinized. Native XRP does not utilize trust lines in this manner, and the DefaultRipple flag is specific to the bridge’s issued tokens.
The exploit occurred as XRP’s price was already declining. The token was trading around $1.02, near a 21-month low, and had fallen approximately 4.4% for the week. This downturn coincided with Bitcoin’s drop to around $64,000 and a broader crypto market decline of roughly $40 billion in a single day.
