Audit log

Every state-changing event for Coreum XRPL Bridge Exploit (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-14 23:04:32Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   92XBNUBZRxjy…1FM2ioLhcopysha256 → base58

   verifying row…

   canonical bytes (19341 B) ▸

   {"actor":"system:backfill","investigation_id":"913c528b-8895-480e-9a55-348543b6fcca","kind":"publish","page_slug":"coreum-xrpl-bridge-exploit-august-2026","published_at":"2026-08-14T23:04:32.451Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Coreum XRPL Bridge Exploit (August 2026)","sections":[{"content":"The Coreum–XRPL bridge was a cross-chain connector allowing users to transfer XRP between the XRP Ledger and the Coreum blockchain. In February 2026, Coreum and Sologenic communities merged into a unified entity called tx, a U.S.-based platform focused on tokenized real-world assets. The TX token replaced both the COREUM and SOLO tokens following a community governance vote that achieved 87.22% approval. Mike McCluskey serves as CEO and Ashley Ebersole as Co-Founder and Chief Legal Officer of tx. The bridge continued operating through the rebranding period. According to CertiK's audit records, Coreum had received at least three security audits, with the most recent delivered in December 2025. tx has also stated the bridge had undergone multiple internal and third-party audits prior to deployment, though these audits did not identify the deposit-verification vulnerability that was later exploited.","heading":"Overview and Background","severity":"medium","sources":[{"credibility":2,"name":"Sologenic and Coreum Communities Join tx as Part of a Unified RWA Ecosystem (GlobeNewswire)","type":"official","url":"https://www.globenewswire.com/news-release/2026/02/17/3239393/0/en/sologenic-and-coreum-communities-join-tx-as-part-of-a-unified-rwa-ecosystem.html"},{"credibility":2,"name":"Coreum - CertiK Skynet Project Insight","type":"research","url":"https://skynet.certik.com/projects/coreum"},{"credibility":2,"name":"Protos: Coreum bridge loses 99.7% of XRP reserve in $200K exploit","type":"news_article","url":"https://protos.com/coreum-bridge-loses-99-7-of-xrp-reserve-in-200k-exploit/"}]},{"content":"At approximately 19:16 UTC on August 9, 2026, an attacker began exploiting a critical flaw in the bridge's relayer verification software. The bridge used a distributed relayer network requiring 17 of 28 relayer node signatures to authorize any withdrawal. The vulnerability lay in how relayers validated deposits: the software scanned the bridge account's transaction history for payments carrying a formatted Coreum recipient memo, but it did not verify that the payment destination matched the bridge's own wallet address. This meant any transaction carrying a correctly formatted memo — regardless of where the funds actually went — could be registered as a legitimate deposit. The attacker exploited this by first creating two new XRPL wallets between approximately 17:34 and 17:57 UTC. The attacker then moved the bridge's own wrapped Coreum token between wallets they controlled, attaching a memo formatted to resemble a genuine bridge deposit. Because all 28 relayers ran identical code containing the same flaw, they reached identical conclusions and each signed off on the fraudulent withdrawal requests. Over 97 minutes, 94 separate multisig-authorized XRP payment transactions were executed, each passing the required 17-of-28 signature threshold. The bridge reserve fell from approximately 200,410 XRP to approximately 493.5 XRP — a depletion of 99.7%. No private keys were compromised; the XRP Ledger protocol and consensus mechanism remained fully secure and unaffected.","heading":"The Exploit: Technical Mechanism","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: XRP Bridge Drained for $200,000 After Software Mistook Fake Deposits for Real Ones","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/12/xrp-bridge-drained-for-usd200-000-after-software-mistook-fake-deposits-for-real-ones"},{"credibility":2,"name":"Crypto Briefing: Nearly 200,000 XRP drained from Coreum cross-chain bridge exploit","type":"news_article","url":"https://cryptobriefing.com/coreum-bridge-exploit-xrp-drained/"},{"credibility":2,"name":"LiveVolatile: TX (Coreum) XRP Bridge Exploit Explained: How a Relayer Flaw Drained 199,916 XRP","type":"news_article","url":"https://www.livevolatile.com/blog/tx-coreum-xrpl-bridge-exploit-relayer-flaw"},{"credibility":2,"name":"Protos: Coreum bridge loses 99.7% of XRP reserve in $200K exploit","type":"news_article","url":"https://protos.com/coreum-bridge-loses-99-7-of-xrp-reserve-in-200k-exploit/"},{"credibility":2,"name":"Coin Edition: Coreum Bridge Breach Drains 199,916 XRP in 97-Minute Exploit Attack","type":"news_article","url":"https://coinedition.com/coreum-bridge-breach-drains-199916-xrp-in-97-minute/"}]},{"content":"The attacker drained 199,916.3 XRP, approximately $200,000 at prices prevailing at the time of the exploit. The bridge reserve dropped from roughly 200,410 XRP to approximately 493.5 XRP — a loss of 99.7% of the reserve. As a direct consequence, bridged XRP held by users on the tx chain is not fully backed by actual XRP on the XRP Ledger. The stolen XRP was distributed across two destination wallets and began moving onward through multiple intermediate addresses within hours of the exploit, according to on-chain tracking cited by CoinDesk. Multiple reports indicate transit wallets used to disperse funds were created approximately 1.5 months before the attack, suggesting some degree of advance planning.","heading":"Financial Impact","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: XRP Bridge Drained for $200,000 After Software Mistook Fake Deposits for Real Ones","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/12/xrp-bridge-drained-for-usd200-000-after-software-mistook-fake-deposits-for-real-ones"},{"credibility":2,"name":"Yahoo Finance: Coreum Bridge Left With Just 493 XRP After 200,000 XRP Exploit","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coreum-bridge-left-just-493-135632816.html"},{"credibility":2,"name":"U.Today: 200,000 XRP Lost in 97 Minutes: Who's to Blame?","type":"news_article","url":"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame"}]},{"content":"tx confirmed the exploit publicly and acknowledged that the bridge software had incorrectly registered transactions that never delivered any XRP to the bridge as deposits, and had minted bridged XRP on the tx chain against those unbacked registrations. The bridge was halted and the vulnerability was patched. tx also stated that blockchain forensics specialists were engaged to assist with the investigation, and that a complaint was filed with the FBI's Internet Crime Complaint Center (IC3). As of August 13, 2026 — four days after the exploit — tx had not released a formal post-mortem report and had not announced a compensation plan for users holding bridged XRP on the tx chain whose assets are no longer fully backed. The U.Today analysis characterized the incident as reflecting a systemic quality-control failure within a company claiming institutional-grade standards, rather than an isolated software bug.","heading":"Official Response and Law Enforcement","severity":"high","sources":[{"credibility":1,"name":"CoinDesk: XRP Bridge Drained for $200,000 After Software Mistook Fake Deposits for Real Ones","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/12/xrp-bridge-drained-for-usd200-000-after-software-mistook-fake-deposits-for-real-ones"},{"credibility":2,"name":"Protos: Coreum bridge loses 99.7% of XRP reserve in $200K exploit","type":"news_article","url":"https://protos.com/coreum-bridge-loses-99-7-of-xrp-reserve-in-200k-exploit/"},{"credibility":2,"name":"Coin-Turk: TX confirms XRP bridge hacked for 200,000 coins, bug fixed, FBI notified","type":"news_article","url":"https://en.coin-turk.com/tx-confirms-xrp-bridge-hacked-for-200000-coins-bug-fixed-fbi-notified/"},{"credibility":2,"name":"U.Today: 200,000 XRP Lost in 97 Minutes: Who's to Blame?","type":"news_article","url":"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame"}]},{"content":"XRP's price briefly fell below $1.00 on August 11, 2026, touching approximately $0.9905 intraday — its first sub-$1 level since January 2024 — before recovering to close at approximately $1.01. Multiple outlets attributed the price decline in part to negative sentiment generated by the bridge exploit, though XRP's price had also been under broader market pressure. The XRP Ledger itself was not compromised in the incident, and Ripple Labs was not involved. The incident prompted scrutiny of third-party bridge infrastructure built on or connecting to the XRP Ledger.","heading":"Market Impact","severity":"medium","sources":[{"credibility":2,"name":"Yahoo Finance: XRP Price Drops Below $1 After Coreum Bridge Hack. First-Time Since 2024","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/xrp-price-drops-below-1-153237020.html"},{"credibility":2,"name":"Benzinga: XRP Falls to $1 as a Bridge Hack Drains 200,000 XRP","type":"news_article","url":"https://www.benzinga.com/crypto/cryptocurrency/26/08/61124788/xrp-falls-to-1-as-a-bridge-hack-drains-200000-xrp-whats-going-on"}]},{"content":"tx stated that the bridge had undergone multiple internal and third-party audits prior to deployment. CertiK's records indicate at least three audits of the Coreum project, with the last delivered in December 2025. Despite this audit history, the deposit-verification flaw — which Protos described as failing on a check as fundamental as confirming the payment destination — was not identified before the exploit. Commentators noted that all 28 relayer operators ran identical code, meaning the flaw was systematically present across the entire relayer network simultaneously. Analysis published by xrpl.to described the bridge as having effectively authorized its own drain by blindly trusting attacker-crafted transaction memos. No finding has been made that any relayer operator acted maliciously; current reporting treats the failure as a code-quality and testing gap rather than insider conduct.","heading":"Prior Audits and Security Practices","severity":"high","sources":[{"credibility":2,"name":"Coreum - CertiK Skynet Project Insight","type":"research","url":"https://skynet.certik.com/projects/coreum"},{"credibility":2,"name":"Protos: Coreum bridge loses 99.7% of XRP reserve in $200K exploit","type":"news_article","url":"https://protos.com/coreum-bridge-loses-99-7-of-xrp-reserve-in-200k-exploit/"},{"credibility":2,"name":"Crypto.news: XRP bridge loses 200,000 XRP after relayer logic flaw","type":"news_article","url":"https://crypto.news/xrp-bridge-loses-200k-xrp-after-relayer-logic-flaw/"},{"credibility":2,"name":"U.Today: 200,000 XRP Lost in 97 Minutes: Who's to Blame?","type":"news_article","url":"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame"}]},{"content":"As of August 13, 2026, users holding bridged XRP (wxXRP or equivalent wrapped tokens) on the tx chain face direct exposure: the underlying XRP Ledger reserve backing those tokens was reduced to approximately 493.5 XRP against a previously fully-backed supply. tx has not announced a reimbursement or recapitalization mechanism. The bridge remains paused, meaning affected users cannot currently withdraw or redeem their bridged positions through the normal bridge route. Users should not assume that a patch to the bridge software resolves the reserve shortfall; the software fix prevents further exploitation but does not replace the 199,916.3 XRP that was removed from the reserve.","heading":"User Risk: Unbacked Bridged Assets","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: XRP Bridge Drained for $200,000 After Software Mistook Fake Deposits for Real Ones","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/12/xrp-bridge-drained-for-usd200-000-after-software-mistook-fake-deposits-for-real-ones"},{"credibility":2,"name":"Crypto Briefing: Nearly 200,000 XRP drained from Coreum cross-chain bridge exploit","type":"news_article","url":"https://cryptobriefing.com/coreum-bridge-exploit-xrp-drained/"},{"credibility":2,"name":"LiveVolatile: TX (Coreum) XRP Bridge Exploit Explained","type":"news_article","url":"https://www.livevolatile.com/blog/tx-coreum-xrpl-bridge-exploit-relayer-flaw"}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: XRP Bridge Drained for $200,000 After Software Mistook Fake Deposits for Real Ones","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/12/xrp-bridge-drained-for-usd200-000-after-software-mistook-fake-deposits-for-real-ones"},{"credibility":2,"name":"Crypto Briefing: Nearly 200,000 XRP drained from Coreum cross-chain bridge exploit","type":"news_article","url":"https://cryptobriefing.com/coreum-bridge-exploit-xrp-drained/"},{"credibility":2,"name":"Protos: Coreum bridge loses 99.7% of XRP reserve in $200K exploit","type":"news_article","url":"https://protos.com/coreum-bridge-loses-99-7-of-xrp-reserve-in-200k-exploit/"},{"credibility":2,"name":"LiveVolatile: TX (Coreum) XRP Bridge Exploit Explained: How a Relayer Flaw Drained 199,916 XRP","type":"news_article","url":"https://www.livevolatile.com/blog/tx-coreum-xrpl-bridge-exploit-relayer-flaw"},{"credibility":2,"name":"U.Today: 200,000 XRP Lost in 97 Minutes: Who's to Blame?","type":"news_article","url":"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame"},{"credibility":2,"name":"Coin Edition: Coreum Bridge Breach Drains 199,916 XRP in 97-Minute Exploit Attack","type":"news_article","url":"https://coinedition.com/coreum-bridge-breach-drains-199916-xrp-in-97-minute/"},{"credibility":2,"name":"Coin-Turk: TX confirms XRP bridge hacked for 200,000 coins, bug fixed, FBI notified","type":"news_article","url":"https://en.coin-turk.com/tx-confirms-xrp-bridge-hacked-for-200000-coins-bug-fixed-fbi-notified/"},{"credibility":2,"name":"Crypto.news: XRP bridge loses 200,000 XRP after relayer logic flaw","type":"news_article","url":"https://crypto.news/xrp-bridge-loses-200k-xrp-after-relayer-logic-flaw/"},{"credibility":2,"name":"Yahoo Finance: Coreum Bridge Left With Just 493 XRP After 200,000 XRP Exploit","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coreum-bridge-left-just-493-135632816.html"},{"credibility":2,"name":"Yahoo Finance: XRP Price Drops Below $1 After Coreum Bridge Hack. First-Time Since 2024","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/xrp-price-drops-below-1-153237020.html"},{"credibility":2,"name":"Benzinga: XRP Falls to $1 as a Bridge Hack Drains 200,000 XRP","type":"news_article","url":"https://www.benzinga.com/crypto/cryptocurrency/26/08/61124788/xrp-falls-to-1-as-a-bridge-hack-drains-200000-xrp-whats-going-on"},{"credibility":2,"name":"GlobeNewswire: Sologenic and Coreum Communities Join tx as Part of a Unified RWA Ecosystem","type":"official","url":"https://www.globenewswire.com/news-release/2026/02/17/3239393/0/en/sologenic-and-coreum-communities-join-tx-as-part-of-a-unified-rwa-ecosystem.html"},{"credibility":2,"name":"Coreum - CertiK Skynet Project Insight","type":"research","url":"https://skynet.certik.com/projects/coreum"},{"credibility":2,"name":"CCN: Coreum Bridge Left With Just 493 XRP After 200,000 XRP Exploit","type":"news_article","url":"https://www.ccn.com/news/crypto/xrp-coreum-bridge-exploit-200000-tokens/"},{"credibility":3,"name":"CoinUnited.io: Coreum–XRPL Bridge Drained of ~200,000 XRP in 97-Minute Exploit","type":"news_article","url":"https://coinunited.io/en/pulse/2026-08-12/coreumxrpl-bridge-drained-of-200000-xrp-in-97-minute-exploit-what-traders-need-to-know"},{"credibility":2,"name":"Smart Contract Hacking: Coreum Hack (2026) — $200K Lost","type":"research","url":"https://smartcontractshacking.com/hacks/coreum-hack-2026"}],"summary":"On August 9, 2026, an attacker exploited a deposit-verification flaw in the cross-chain bridge connecting the XRP Ledger to the Coreum blockchain (operated by tx, formerly Coreum and Sologenic), draining 199,916.3 XRP — approximately $200,000 and 99.7% of the bridge's total reserve — across 94 multisig transactions over 97 minutes. The bridge was halted by tx as of August 11, 2026; bridged XRP on the tx chain is not fully backed as of the most recent reporting, and no compensation plan had been announced as of August 13, 2026.","timeline":[{"date":"2026-02-17","event":"Coreum and Sologenic communities announce merger into tx, a U.S.-based real-world asset tokenization platform. COREUM and SOLO tokens begin migration to a unified TX token. The XRPL bridge continues operating.","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2026/02/17/3239393/0/en/sologenic-and-coreum-communities-join-tx-as-part-of-a-unified-rwa-ecosystem.html"},{"date":"2026-08-09","event":"At approximately 17:34–17:57 UTC, the attacker creates two new XRPL wallet addresses, later used to receive stolen funds.","source":"LiveVolatile","source_url":"https://www.livevolatile.com/blog/tx-coreum-xrpl-bridge-exploit-relayer-flaw"},{"date":"2026-08-09","event":"At 19:16 UTC, the attacker submits the first fraudulent deposit memo, triggering the bridge's relayer network to authorize XRP withdrawals against an unbacked balance.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/08/12/xrp-bridge-drained-for-usd200-000-after-software-mistook-fake-deposits-for-real-ones"},{"date":"2026-08-09","event":"Between 19:16 and 20:53 UTC (97 minutes), the attacker executes 94 separate multisig-authorized XRP payments totaling 199,916.3 XRP, draining the bridge reserve from approximately 200,410 XRP to approximately 493.5 XRP.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/coreum-bridge-exploit-xrp-drained/"},{"date":"2026-08-09","event":"Stolen XRP begins moving through multiple intermediate wallets within hours of the drain. On-chain analysis indicates transit wallets used to disperse funds were created approximately 1.5 months prior to the attack.","source":"CoinDesk / U.Today","source_url":"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame"},{"date":"2026-08-11","event":"tx publicly confirms the exploit, announces the bridge is halted, states the vulnerability has been patched, discloses engagement of blockchain forensics specialists, and confirms an FBI Internet Crime Complaint Center (IC3) complaint has been filed. tx acknowledges that bridged XRP on the tx chain is not currently fully backed.","source":"Coin-Turk / CoinDesk","source_url":"https://en.coin-turk.com/tx-confirms-xrp-bridge-hacked-for-200000-coins-bug-fixed-fbi-notified/"},{"date":"2026-08-11","event":"XRP price falls below $1.00 intraday, touching approximately $0.9905 — its first sub-$1 level since January 2024 — before recovering to close around $1.01. Multiple outlets link the decline in part to sentiment from the bridge exploit.","source":"Yahoo Finance","source_url":"https://finance.yahoo.com/markets/crypto/articles/xrp-price-drops-below-1-153237020.html"},{"date":"2026-08-13","event":"As of this date, tx has not published a formal post-mortem report and has not announced a plan to compensate users holding unbacked bridged XRP. The bridge remains paused.","source":"LiveVolatile","source_url":"https://www.livevolatile.com/blog/tx-coreum-xrpl-bridge-exploit-relayer-flaw"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3e64858f-8b90-4acb-a65d-755639e1128bcopy