Coreum Bridge Drained of 200,000 XRP in Logic Flaw

The incident unfolded between 19:16 and 20:53 UTC, during which the bridge’s balance plummeted from approximately 200,410 XRP to just 493.5 XRP. On-chain analysis indicates the attacker did not compromise the underlying XRP Ledger. Instead, they manipulated how Coreum’s relayers interpret transaction data. By executing wallet-to-wallet transfers of wrapped Coreum tokens with specifically formatted memos, the attacker tricked the system into recognizing these transfers as legitimate deposits. Because the relayer code failed to verify the payment destination address, the bridge authorized 17 of its 28 relayer signatures to process withdrawals for funds that were never actually deposited.

Initial claims suggesting the "rippling" of assets caused the breach were dismissed by subsequent technical reviews. Ledger documentation confirms that native XRP does not utilize the trust lines required for such rippling, and transaction records show the funds were moved through authorized bridge payments rather than unauthorized asset flows. While the stolen assets were quickly funneled into staging wallets, the bridge remains halted. Coreum has yet to release a formal incident report or a timeline for reopening, leaving the security of the bridge's relayer architecture as the primary point of failure.