Coreum XRPL Bridge Exploit (August 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2tuESG…QtxUSummary
On August 9, 2026, an attacker exploited a deposit-verification flaw in the cross-chain bridge connecting the XRP Ledger to the Coreum blockchain (operated by tx, formerly Coreum and Sologenic), draining 199,916.3 XRP — approximately $200,000 and 99.7% of the bridge's total reserve — across 94 multisig transactions over 97 minutes. The bridge was halted by tx as of August 11, 2026; bridged XRP on the tx chain is not fully backed as of the most recent reporting, and no compensation plan had been announced as of August 13, 2026.
Connected Entities
2 entities · 5 linked investigations- Coreum XRPL Bridge Exploit (August 2026)→mentioned with→Ripple Labs(80%)
Connected Through
1 shared actor · 5 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ripple Labsorganization
5 submissions awaiting moderator review.
Timeline(8 events)
17 February 2026
Coreum and Sologenic communities announce merger into tx, a U.S.-based real-world asset tokenization platform. COREUM and SOLO tokens begin migration to a unified TX token. The XRPL bridge continues operating.
GlobeNewswire9 August 2026
At approximately 17:34–17:57 UTC, the attacker creates two new XRPL wallet addresses, later used to receive stolen funds.
LiveVolatile9 August 2026
At 19:16 UTC, the attacker submits the first fraudulent deposit memo, triggering the bridge's relayer network to authorize XRP withdrawals against an unbacked balance.
CoinDesk9 August 2026
Between 19:16 and 20:53 UTC (97 minutes), the attacker executes 94 separate multisig-authorized XRP payments totaling 199,916.3 XRP, draining the bridge reserve from approximately 200,410 XRP to approximately 493.5 XRP.
Crypto Briefing9 August 2026
Stolen XRP begins moving through multiple intermediate wallets within hours of the drain. On-chain analysis indicates transit wallets used to disperse funds were created approximately 1.5 months prior to the attack.
CoinDesk / U.Today11 August 2026
tx publicly confirms the exploit, announces the bridge is halted, states the vulnerability has been patched, discloses engagement of blockchain forensics specialists, and confirms an FBI Internet Crime Complaint Center (IC3) complaint has been filed. tx acknowledges that bridged XRP on the tx chain is not currently fully backed.
Coin-Turk / CoinDesk11 August 2026
XRP price falls below $1.00 intraday, touching approximately $0.9905 — its first sub-$1 level since January 2024 — before recovering to close around $1.01. Multiple outlets link the decline in part to sentiment from the bridge exploit.
Yahoo Finance13 August 2026
As of this date, tx has not published a formal post-mortem report and has not announced a plan to compensate users holding unbacked bridged XRP. The bridge remains paused.
LiveVolatileDecision Log
- slot 443514916 · hash 2hUVn87oR6dR5h5i4wC3J1YakSy5UoTyVxS4KRogCk4r
- slot 443514909 · hash BhgymhMVsFVhuBzmrECmpCLeCG81LtPTQN6hZVQBFWD7
- slot 443507557 · hash 92XBNUBZRxjyj1cCqBfmBr5zenbmESDAKXKT1FM2ioLh
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 13 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/14/2026, 11:04:24 PM
last updated: 8/25/2026, 1:52:01 PM
4 viewsavoid.net — verified advice for a post-truth world