XRP Bridge Drained of 199,916 Tokens in 97-Minute Exploit

An XRP bridge lost nearly 200,000 XRP, worth roughly $200,000 at current prices, after a software flaw let an attacker claim deposits that were never made and then withdraw real tokens against the fake balances. The bridge connects the XRP Ledger to Coreum, a blockchain that rebranded in March 2026 as tx, a U.S.-based firm focused on tokenizing real-world assets. The attack drained the bridge’s reserve wallet from roughly 200,410 XRP down to just 493.5 XRP in 97 minutes on August 9, before the system was halted.

How the Fake Deposits Fooled the Bridge

A cross-chain bridge functions like a vault paired with a receipt system: a user sends XRP into a reserve wallet on the XRP Ledger, and the bridge issues an equivalent amount of bridged XRP on the connected chain. Returning those bridged tokens later lets the holder withdraw the real XRP held in reserve. The attacker found a way to make the system issue receipts without ever depositing anything into the vault, instead moving the bridge’s own tokens between two wallets they controlled while attaching a fake deposit label to the transaction, according to CryptoBriefing. The bridge’s relayer software read that internal transfer, mistook it for a genuine incoming deposit, and credited the attacker with bridged XRP they had never actually sent.

With a fabricated balance now showing on the system, the attacker simply requested standard withdrawals, and the bridge approved every one. On-chain data shows 94 fraudulent payment transactions executed across the 97-minute window, from 19:16 to 20:53 UTC. Each payout required sign-off from 17 of the bridge’s 28 relayers, a majority approving exactly as the system was designed to function, because the bridge’s own transaction records told them the deposits were legitimate. Relayers are software programs that monitor both blockchains and authorize transfers whenever the bridge’s records indicate a withdrawal is owed.

A Verification Gap, Not a Broken Ledger

The specific failure sat one layer beneath the relayer approval process itself: the relayer code processed payments carrying the bridge’s memo field without first verifying that the transaction actually delivered XRP to the correct destination address. tx confirmed the deposit-detection flaw in a public update, stating that the attacker exploited software that incorrectly recognized transactions delivering no XRP to the reserve. The XRP Ledger’s own consensus mechanism and cryptography were not compromised; the flaw lived entirely in the bridge’s off-chain verification logic, a relayer-based design that trades cryptographic proof for operational simplicity.

tx said it has identified and fixed the vulnerable code, engaged blockchain forensics specialists, and filed a complaint with the FBI’s Internet Crime Complaint Center. The company has not yet said how affected holders will be made whole, and as of publication had not released a full incident report. Onchain tracking shows most of the stolen XRP moved onward within hours through several additional wallets, a pattern commonly associated with laundering stolen funds.

• The bridge’s reserve wallet fell from roughly 200,410 XRP to 493.5 XRP during the attack
• The exploit required no compromise of private keys or the XRP Ledger itself, only a flaw in how the bridge’s relayers verified deposits

Conclusion

The Coreum bridge exploit adds to a growing list of 2026 incidents where the underlying blockchain remained secure while the connecting infrastructure failed, following a $292 million bridge drain at Kelp DAO and a $24.15 million loss at AFX Trade earlier this year. Blockaid’s first-half security report recorded 212 on-chain exploits and more than $1.1 billion in losses industry-wide during the same period, with governance and verification failures playing an increasingly prominent role. For a company positioning itself as an institutional-grade platform for tokenized real-world assets, the basic nature of the verification gap raises questions about internal quality control that may prove more damaging to tx’s reputation than the roughly $200,000 lost in the attack itself.