12th August 2026 – (Copenhagen) Close to 200,000 XRP was siphoned from the Coreum cross‑chain bridge in a 97‑minute exploit on 9th August, after attackers manipulated the bridge’s deposit‑confirmation process rather than any component of the XRP Ledger itself. The bridge, which links the XRP Ledger and Coreum to enable asset movement between otherwise incompatible networks, allowed users to lock XRP on one side and receive a representative token on the other. Prior to the incident the bridge custodied about 200,410 XRP and was left with just 493.5 XRP once the draining ceased, according to on‑chain traces.
The outflows began at approximately 7.16pm UTC and concluded at around 8.53pm UTC, during which the bridge account executed 94 transfers totalling roughly 199,916.3 XRP to two newly created wallets. Each payment was properly authorised under the bridge’s multisignature policy: relayer nodes that observe both chains signed the transactions, with 17 of 28 required keys approving each release.
Investigators said the weakness lay in the bridge’s verification logic. Relayers were expected to attest that a legitimate deposit had been received before green‑lighting a payout, but the software failed to verify that the incoming payment had actually been sent to the bridge address. That omission enabled the attacker to shuttle funds between their own addresses, label those internal movements as deposits and trigger real XRP withdrawals. In effect, the signing process functioned as designed, but it was acting on false evidence.
No private keys were reported compromised, and analysts stressed that the XRP Ledger’s consensus and transaction rules were not implicated. Coreum has suspended the bridge while engineers address the flaw and prepare an official incident report. XRP briefly dipped below the one‑dollar mark on 11th August, touching 0.99 dollars before stabilising near 1.01 dollars at the time of writing.