Incident Overview
On August 9, 2026, the Coreum cross-chain bridge connecting to the XRP Ledger (XRPL) was exploited due to a deposit verification flaw, resulting in the theft of 199,916 XRP (valued at approximately $200,000) across 94 transactions within 97 minutes.
The attack targeted a vulnerability in the Coreum bridge's deposit verification logic and multisig relayer infrastructure connecting the Coreum blockchain to the XRP Ledger. By exploiting a flaw in how incoming cross-chain deposit proofs were validated, the attacker tricked the relayer system into recognizing unverified or forged deposit events as legitimate. Over a 97-minute window, the attacker executed 94 consecutive fraudulent withdrawal requests, systematically siphoning 199,916 XRP out of the bridge liquidity before operations could be suspended.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Coreum, these are the critical security checks that could have prevented this incident (August 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Coreum
The Coreum hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.