{"id":36972,"date":"2026-08-11T12:54:10","date_gmt":"2026-08-11T12:54:10","guid":{"rendered":"https:\/\/bitunikey.com\/news\/xrp-bridge-loses-200000-xrp-after-relayer-logic-flaw\/"},"modified":"2026-08-11T12:54:30","modified_gmt":"2026-08-11T12:54:30","slug":"xrp-bridge-loses-200000-xrp-after-relayer-logic-flaw","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/xrp-bridge-loses-200000-xrp-after-relayer-logic-flaw\/","title":{"rendered":"XRP bridge loses 200,000 XRP after relayer logic flaw"},"content":{"rendered":"<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">Nearly 200,000 XRP was drained from the Coreum XRPL bridge on Aug. 9 after an attacker appears to have exploited a flaw in its relayer logic, rather than a vulnerability in the XRP Ledger itself.\u00a0<\/p>\n<div id=\"cn-block-summary-block_3dd7efe546243696ad454203f253b8c2\" class=\"cn-block-summary\">\n<div class=\"cn-block-summary__nav tabs\">\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/div>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>Nearly 200,000 XRP left Coreum\u2019s bridge in 94 signed payments during a 97 minute attack.<\/li>\n<li>Blockchain analysis found 17 of 28 relayer signatures authorized each XRP payout from the bridge.<\/li>\n<li>Relayer code processed successful payments with bridge memos without verifying the payment destination address first.<\/li>\n<li>XRPL documentation confirms native XRP has no trust line, contradicting the initial rippling explanation directly.<\/li>\n<li>Coreum had not published an official incident report by Tuesday while the bridge remained halted.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>On chain <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/xrpl.to\/insights\/coreum-bridge-xrp-drain\" target=\"_blank\" rel=\"nofollow\">analysis<\/a> published Aug. 11 traced 199,916.3 XRP leaving the bridge account through 94 payments over 97 minutes.<\/p>\n<p>The bridge held about 200,410 XRP before the sequence began at 19:16 UTC. By 20:53 UTC, its balance had fallen to 493.5 XRP. Every outgoing XRP payment carried the bridge\u2019s own multisignature authorization, with 17 signatures from its 28 relayer keys. The evidence does not indicate that those keys were stolen.<\/p>\n<figure class=\"wp-block-image size-large\"><figcaption class=\"wp-element-caption\">Coreum bridge drained of XRP, source: XRPL.to<\/figcaption><\/figure>\n<p>    <!-- .cn-block-related-link --><\/p>\n<h2 class=\"wp-block-heading\"><strong>XRP bridge relayers mistook self payments for deposits<\/strong><\/h2>\n<p>The attack appears to have targeted how Coreum\u2019s relayers interpreted transactions. The attacker first moved the bridge\u2019s own wrapped Coreum token between wallets under their control while attaching a memo formatted for the bridge. Those transactions appeared in the bridge account\u2019s history because the account issues the wrapped token.<\/p>\n<p>The public relayer <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/github.com\/CoreumFoundation\/coreumbridge-xrpl\/blob\/master\/relayer\/processes\/xrpl_to_coreum.go\" target=\"_blank\" rel=\"nofollow\">code<\/a> checks whether a payment succeeded, extracts a Coreum recipient from its memo and reads the delivered amount before submitting deposit evidence. However, the published processing flow does not compare the payment\u2019s destination with the bridge address. That allowed wallet to wallet transfers carrying the right memo to be interpreted as deposits.<\/p>\n<p>XRPL.to found that 21 relayers attested the attacker\u2019s first phantom transaction. Once enough matching evidence reached the Coreum contract, the system credited balances that were not backed by real deposits. The attacker then used the bridge\u2019s normal withdrawal process, prompting its relayers to authorize real XRP payments.<\/p>\n<p>The pattern resembles a wider bridge security problem discussed in recent security coverage: cross chain systems can fail even when their underlying blockchains remain secure if the mechanism verifying events on another chain accepts incorrect information.<\/p>\n<h2 class=\"wp-block-heading\"><strong>XRP Ledger data contradicts the rippling theory<\/strong><\/h2>\n<p>An initial warning blamed <strong>\u201crippling\u201d<\/strong> and the bridge account\u2019s DefaultRipple setting. The later transaction analysis rejected that explanation. XRP Ledger <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/xrpl.org\/docs\/concepts\/tokens\/fungible-tokens\/trust-line-tokens\" target=\"_blank\" rel=\"nofollow\">documentation<\/a> states that rippling applies to issued assets held through trust lines. Native XRP does not use those trust lines.<\/p>\n<p>The transaction record provides another distinction. XRPL.to attributed all 199,916.3 XRP removed from the account to payments signed by the bridge itself and found no XRP leaving through a rippling route. It also found that the transactions were not partial payments.<\/p>\n<p>The incident therefore does not currently point to an XRP Ledger consensus failure. That distinction is relevant after developers recently strengthened review of XRPL software and proposed features, as covered in previous software audit coverage. The Coreum incident instead centers on software connecting two independent networks.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Stolen XRP moves onward as bridge stays halted<\/strong><\/h2>\n<p>The two initial receiving wallets forwarded nearly all the XRP within hours. XRPL.to traced roughly 169,000 XRP into two staging accounts created on June 28, with another roughly 34,000 XRP moving toward three other wallets. The analysis has not identified the attacker.<\/p>\n<p>No further XRP left the bridge after 20:53 UTC on Aug. 9. Its account made one additional wrapped token transaction early the next morning before going silent, while the bridge contract was subsequently reported halted. Coreum had not published an official post incident account when the Aug. 11 analysis was released.<\/p>\n<p>The bridge\u2019s own <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/github.com\/CoreumFoundation\/coreumbridge-xrpl\/blob\/master\/spec\/spec.md\" target=\"_blank\" rel=\"nofollow\">specification<\/a> allows any relayer or the contract owner to halt operations when unexpected behavior occurs, while only the owner can resume them. The next steps to watch are a formal incident report, remediation of the destination verification flaw, any recovery efforts involving the transferred XRP and a decision on when the bridge can safely reopen.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Nearly 200,000 XRP was drained from the Coreum XRPL bridge on Aug. 9 after an attacker appears to have exploited a flaw in its relayer logic, rather than a vulnerability&hellip;<\/p>\n","protected":false},"author":1,"featured_media":32882,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-36972","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/36972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=36972"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/36972\/revisions"}],"predecessor-version":[{"id":36973,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/36972\/revisions\/36973"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/32882"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=36972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=36972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=36972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}