200K XRP Stolen in 97-Minute Coreum Bridge Attack Incident

What happened on the Coreum bridge

A sophisticated 97-minute attack on the Coreum cross-chain bridge resulted in the loss of roughly 200,000 XRP. On-chain analysis shows the breach did not exploit the XRP Ledger itself but rather a logical validation flaw in the bridge's deposit-handling process. The attacker manipulated on-chain transactions to trick the bridge into treating fake deposits as legitimate, allowing unauthorized XRP withdrawals.

How the attacker deceived validators

Technical cause

Investigators determined the attacker did not obtain private keys or directly compromise validator accounts. Instead, the exploit relied on crafted transactions featuring Wrapped-CORE tokens and falsified memo or descriptor fields. The bridge’s validation logic checked token transfers and transaction metadata but failed to verify that recipient addresses matched expected destinations. As a result, fake deposits were accepted as real collateral and validators signed off on outgoing XRP transfers.

On-chain evidence

Blockchain forensic teams traced the sequence of transfers and confirmed the unusual pattern of wrapped CORE movements preceding the XRP withdrawals. The incident underscores risks specific to cross-chain bridges and the importance of strict address and state validation in bridge smart contracts and relayer logic.

Market impact and price reaction

Short-term sentiment

The exploit introduced short-term negative sentiment for XRP and raised fresh concerns about bridge security across the crypto ecosystem. As of writing, XRP was trading near the psychological $1 support level and had dropped about 2.5% on the day. Importantly, no vulnerability has been identified in the XRP Ledger itself.

Recommendations for investors

Risk management guidance

This event is a reminder that infrastructure risks — including cross-chain bridges, smart contracts, and validator logic — can affect asset exposure even when underlying blockchains remain secure. Crypto investors should evaluate counterparty and bridge risk, limit exposure to new or unaudited bridge projects, and prefer platforms with comprehensive security audits and rigorous address-validation procedures.

For developers and bridge operators, the incident highlights the need for defense-in-depth: improved validation checks, stricter memo/address verification, and transparent incident response plans to protect funds and restore market confidence.