What happened
On August 9, 2026, the Coreum (now tx) bridge on the XRP Ledger lost 199,916.3 XRP in 94 signed payments after its relayers treated memo-bearing payments as bridge deposits without confirming the payments were sent to the bridge.
The relayer's deposit-validation path accepted a payment memo as evidence of a bridge deposit without checking that the payment destination matched the bridge's XRP Ledger address.
How it happened
The attacker created payments that carried Coreum recipient memos but were not deposits to the bridge. The relayer accepted those records as deposit evidence, and the bridge's multisig relayers signed real XRP withdrawals from its reserve.
Protocol details
Evidence
- report Report binance.com
- report Report tradingview.com
- code Coreum XRPL bridge repository github.com
- analysis DeFiLlama defillama.com
- analysis SigIntZero: Coreum bridge analysis sigintzero.com
- analysis crypto.news: XRP bridge loses 200,000 XRP crypto.news
- analysis CoinDesk: Coreum bridge incident coindesk.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
