← Coreum XRPL Bridge Exploit (August 2026)reviewed 2026-10-17 · 21 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Coreum XRPL Bridge Exploit (August 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in section: The Exploit: Technical Mechanism
“Because all 28 relayers ran identical code containing the same flaw, they reached identical conclusions and each signed off on the fraudulent withdrawal requests.”
reviewerBecause all 28 relayers ran identical code containing the same flaw, each independently signed off on the fraudulent withdrawals.The 17-of-28 threshold and shared vulnerability are confirmed, but no source I could access explicitly confirms that every one of the 28 relayer operators runs byte-identical software versus merely compatible reference code. - #13[unverifiable][awaiting moderator]in section: Overview and Background
“The TX token replaced both the COREUM and SOLO tokens following a community governance vote that achieved 87.22% approval.”
reviewerThe governance vote that approved the merger achieved 87.22% approval.This specific figure is highly precise but I could not locate it in any secondary source, and the only cited primary source was inaccessible by both direct fetch and archive. Could not confirm or refute. - #15[unverifiable][awaiting moderator]in section: Overview and Background
“Mike McCluskey serves as CEO and Ashley Ebersole as Co-Founder and Chief Legal Officer of tx.”
reviewerAshley Ebersole serves as Co-Founder and Chief Legal Officer of tx.Could not find any source independently confirming this specific name/title pairing at tx; the only cited source (GlobeNewswire) was inaccessible.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #21[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260815003116/https://en.coin-turk.com/jake-claver-says-50-million-liquidity-is-key-for-xrps-use-by-banks/?rbsnp=1”
reviewerCoin-Turk archive capture for the 'tx confirms XRP bridge hacked' article.The archive_url recorded for this source does not match its own url field — it archives a completely different Coin-Turk article (about XRP bank liquidity commentary by Jake Claver), not the bridge-hack article being cited. A working snapshot of the correct URL exists and is proposed as the replacement.Proposed correction (not yet applied)http://web.archive.org/web/20261015215806/https://en.coin-turk.com/tx-confirms-xrp-bridge-hacked-for-200000-coins-bug-fixed-fbi-notified/
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #9[partially supported][awaiting moderator]in section: Official Response and Law Enforcement
“As of August 13, 2026 — four days after the exploit — tx had not released a formal post-mortem report and had not announced a compensation plan for users holding bridged XRP on the tx chain whose assets are no longer fully backed.”
reviewerAs of August 13, 2026, tx had not released a formal post-mortem report and had not announced a compensation plan for affected users.The page's framing is supported by the higher-credibility CoinDesk source and LiveVolatile, but one of its own cited sources for this exact section (Coin-Turk) reports that tx had already announced it was finalizing a compensation plan and had released an official investigation report — the page does not address or reconcile this conflicting citation. - #11[partially supported][awaiting moderator]in section: Market Impact
“XRP's price briefly fell below $1.00 on August 11, 2026, touching approximately $0.9905 intraday — its first sub-$1 level since January 2024 — before recovering to close at approximately $1.01.”
reviewerXRP briefly fell below $1.00 on August 11, 2026, touching approximately $0.9905 intraday — its first sub-$1 level since January 2024 — before recovering to close at approximately $1.01.The directional claim (brief sub-$1 dip around the exploit, quick recovery) is well supported, but the specific $0.9905 low and 'since January 2024' framing could not be confirmed via the page's actual cited sources (Yahoo Finance and Benzinga both returned 403 to automated fetch) and conflict with other reputable outlets reporting $0.996 and 'since November 2024'. - #14[partially supported][awaiting moderator]in section: Overview and Background
“Mike McCluskey serves as CEO and Ashley Ebersole as Co-Founder and Chief Legal Officer of tx.”
reviewerMike McCluskey serves as CEO of tx.McCluskey's prior role as Sologenic CEO and his continuation into a tx leadership role are corroborated by secondary sources, but the page's primary source (GlobeNewswire) could not be independently accessed, so his specific 'CEO of tx' title at the time of the exploit is corroborated only secondhand. - #18[partially supported][awaiting moderator]in section: Prior Audits and Security Practices
“Analysis published by xrpl.to described the bridge as having effectively authorized its own drain by blindly trusting attacker-crafted transaction memos.”
reviewerAnalysis published by xrpl.to described the bridge as having effectively authorized its own drain by blindly trusting attacker-crafted transaction memos.The underlying claim is substantively accurate per crypto.news, which itself cites xrpl.to, but xrpl.to is not listed among this section's sources or the page's sources_used, so the attribution is not independently traceable from the page's own citation trail.
confirmed
13 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“draining 199,916.3 XRP — approximately $200,000 and 99.7% of the bridge's total reserve — across 94 multisig transactions over 97 minutes”
reviewerOn August 9, 2026, an attacker drained 199,916.3 XRP (~$200,000, 99.7% of bridge reserve) across 94 multisig transactions over 97 minutes.Core figures are consistently corroborated across multiple independent outlets (CoinDesk, Protos, OneKey, KuCoin, Whale Alert). - #2[confirmed][no action needed]in section: The Exploit: Technical Mechanism
“At approximately 19:16 UTC on August 9, 2026, an attacker began exploiting a critical flaw in the bridge's relayer verification software.”
reviewerAt approximately 19:16 UTC on August 9, 2026, the attacker began exploiting the relayer verification flaw; the bridge required 17-of-28 relayer signatures.Mechanism description matches CoinDesk and Protos reporting closely. - #3[confirmed][no action needed]in the timeline
“At approximately 17:34–17:57 UTC, the attacker creates two new XRPL wallet addresses, later used to receive stolen funds.”
reviewerThe attacker first created two new XRPL wallets between approximately 17:34 and 17:57 UTC on August 9, 2026.Directly confirmed by the cited source. - #4[confirmed][no action needed]in section: The Exploit: Technical Mechanism
“No private keys were compromised; the XRP Ledger protocol and consensus mechanism remained fully secure and unaffected.”
reviewerNo private keys were compromised; the XRP Ledger protocol and consensus remained secure.Consistently reported across outlets that this was a logic flaw, not a key compromise, and the XRP Ledger itself was unaffected. - #6[confirmed][no action needed]in section: Financial Impact
“The bridge reserve dropped from roughly 200,410 XRP to approximately 493.5 XRP — a loss of 99.7% of the reserve.”
reviewerThe attacker drained 199,916.3 XRP, approximately $200,000; the bridge reserve dropped from ~200,410 XRP to ~493.5 XRP, a 99.7% loss.Figure is consistent across every outlet consulted. - #7[confirmed][no action needed]in section: Financial Impact
“Multiple reports indicate transit wallets used to disperse funds were created approximately 1.5 months before the attack, suggesting some degree of advance planning.”
reviewerThe stolen XRP was distributed across two destination wallets and began moving through intermediate addresses within hours; transit wallets were created approximately 1.5 months before the attack.Both the two-destination-wallet detail and the ~1.5-month-old transit wallet detail are independently corroborated. - #8[confirmed][no action needed]in section: Official Response and Law Enforcement
“tx also stated that blockchain forensics specialists were engaged to assist with the investigation, and that a complaint was filed with the FBI's Internet Crime Complaint Center (IC3).”
reviewertx confirmed the exploit, stated bridged XRP was minted against unbacked registrations, engaged forensics specialists, and filed an FBI IC3 complaint.Confirmed by both a tier-1 and tier-2 source. - #10[confirmed][no action needed]in section: Official Response and Law Enforcement
“The U.Today analysis characterized the incident as reflecting a systemic quality-control failure within a company claiming institutional-grade standards, rather than an isolated software bug.”
reviewerThe U.Today analysis characterized the incident as reflecting a systemic quality-control failure rather than an isolated bug.Faithful characterization of the cited source's argument. - #12[confirmed][no action needed]in section: Overview and Background
“In February 2026, Coreum and Sologenic communities merged into a unified entity called tx, a U.S.-based platform focused on tokenized real-world assets.”
reviewerIn February 2026, Coreum and Sologenic communities merged into tx; the TX token replaced COREUM and SOLO following a governance vote.The merger itself and the token migration are corroborated by secondary reporting even though the primary GlobeNewswire release returned HTTP 403 to automated fetch. - #16[confirmed][no action needed]in section: Overview and Background
“According to CertiK's audit records, Coreum had received at least three security audits, with the most recent delivered in December 2025.”
reviewerCoreum received at least three security audits per CertiK, with the most recent delivered in December 2025.Directly verified against the live CertiK Skynet page. - #17[confirmed][no action needed]in section: Prior Audits and Security Practices
“Despite this audit history, the deposit-verification flaw — which Protos described as failing on a check as fundamental as confirming the payment destination — was not identified before the exploit.”
reviewerDespite the audit history, the deposit-verification flaw was not identified before the exploit; Protos described it as failing a check as fundamental as confirming the payment destination.Faithful to the cited source. - #19[confirmed][no action needed]in section: Prior Audits and Security Practices
“No finding has been made that any relayer operator acted maliciously; current reporting treats the failure as a code-quality and testing gap rather than insider conduct.”
reviewerNo finding has been made that any relayer operator acted maliciously; current reporting treats the failure as a code-quality/testing gap rather than insider conduct.Consistent with all sources reviewed; no outlet alleges insider involvement. - #20[confirmed][no action needed]in section: User Risk: Unbacked Bridged Assets
“tx has not announced a reimbursement or recapitalization mechanism.”
reviewerThe bridge remains paused as of August 13, 2026, and tx has not announced a reimbursement or recapitalization mechanism.Same caveat as the Official Response finding above regarding the Coin-Turk source applies, but the balance of evidence (including this section's own cited LiveVolatile source) supports the claim as of Aug 13.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.