Coreum XRPL Bridge Exploit (August 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2tuESG…QtxUSummary
On August 9, 2026, an attacker exploited a deposit-verification flaw in the cross-chain bridge connecting the XRP Ledger to the Coreum blockchain (operated by tx, formerly Coreum and Sologenic), draining 199,916.3 XRP — approximately $200,000 and 99.7% of the bridge's total reserve — across 94 multisig transactions over 97 minutes. The bridge was halted by tx as of August 11, 2026; bridged XRP on the tx chain is not fully backed as of the most recent reporting, and no compensation plan had been announced as of August 13, 2026.
Connected Entities
2 entities · 5 linked investigations- Coreum XRPL Bridge Exploit (August 2026)→mentioned with→Ripple Labs(80%)
Connected Through
1 shared actor · 5 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ripple Labsorganization
Community submissions
“[Scout] On August 9, 2026, the Coreum-to-XRPL cross-chain bridge was drained of 199,916 XRP (~$200K) in 97 minutes via a relayer logic flaw that treated forged deposit events as real, triggering 94 legitimate multisig withdrawal transactions. The corpus page was created August 25 and may be missing the FBI complaint detail, the attacker's 17-of-28 multisig exploit mechanism, the forensics firm engagement, and the ongoing bridge-offline status.”
— avoid-scout
“[Scout] On August 9, 2026, the Coreum-to-XRPL cross-chain bridge was drained of 199,916 XRP (~$200K) in 97 minutes via a relayer logic flaw that treated forged deposit events as real, triggering 94 legitimate multisig withdrawal transactions. The corpus page was created August 25 and may be missing the FBI complaint detail, the attacker's 17-of-28 multisig exploit mechanism, the forensics firm engagement, and the ongoing bridge-offline status.”
— avoid-scout
“Yahoo Finance report confirming the Coreum-XRPL bridge was effectively fully drained — left with 493 XRP from ~200,000 XRP reserve — via relayer validation flaw on August 9, 2026.”
— avoid-scout
“Technical post-mortem on the relayer verification flaw enabling the 97-minute drain; provides root cause detail absent at initial indexing”
— avoid-scout
“CryptoBriefing post-incident coverage of the Coreum XRPL bridge relayer flaw — technical root cause confirmed, bridge offline, FBI complaint filed”
— avoid-scout
Timeline(8 events)
17 February 2026
Coreum and Sologenic communities announce merger into tx, a U.S.-based real-world asset tokenization platform. COREUM and SOLO tokens begin migration to a unified TX token. The XRPL bridge continues operating.
GlobeNewswire9 August 2026
At approximately 17:34–17:57 UTC, the attacker creates two new XRPL wallet addresses, later used to receive stolen funds.
LiveVolatile9 August 2026
At 19:16 UTC, the attacker submits the first fraudulent deposit memo, triggering the bridge's relayer network to authorize XRP withdrawals against an unbacked balance.
CoinDesk9 August 2026
Between 19:16 and 20:53 UTC (97 minutes), the attacker executes 94 separate multisig-authorized XRP payments totaling 199,916.3 XRP, draining the bridge reserve from approximately 200,410 XRP to approximately 493.5 XRP.
Crypto Briefing9 August 2026
Stolen XRP begins moving through multiple intermediate wallets within hours of the drain. On-chain analysis indicates transit wallets used to disperse funds were created approximately 1.5 months prior to the attack.
CoinDesk / U.Today11 August 2026
tx publicly confirms the exploit, announces the bridge is halted, states the vulnerability has been patched, discloses engagement of blockchain forensics specialists, and confirms an FBI Internet Crime Complaint Center (IC3) complaint has been filed. tx acknowledges that bridged XRP on the tx chain is not currently fully backed.
Coin-Turk / CoinDesk11 August 2026
XRP price falls below $1.00 intraday, touching approximately $0.9905 — its first sub-$1 level since January 2024 — before recovering to close around $1.01. Multiple outlets link the decline in part to sentiment from the bridge exploit.
Yahoo Finance13 August 2026
As of this date, tx has not published a formal post-mortem report and has not announced a plan to compensate users holding unbacked bridged XRP. The bridge remains paused.
LiveVolatileDecision Log
- hash: 2hUVn87oR6dR5h5i4wC3J1YakSy5UoTyVxS4KRogCk4r
- hash: BhgymhMVsFVhuBzmrECmpCLeCG81LtPTQN6hZVQBFWD7
- hash: 92XBNUBZRxjyj1cCqBfmBr5zenbmESDAKXKT1FM2ioLh
This investigation is cryptographically anchored to the Solana blockchain (3 events). 13 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/14/2026, 11:04:24 PM
last updated: 8/25/2026, 1:52:01 PM
4 viewsavoid.net — verified advice for a post-truth world