[DigitalToday reporter Jinju Hong (홍진주)] An incident in which about 200,000 XRP was stolen from the Coreum cross-chain bridge appears to have stemmed not from a functional flaw in the XRP Ledger (XRPL) but from a problem in the bridge’s own verification logic. The attacker exploited lax deposit checks by validators to disguise a transaction as legitimate without actually depositing funds, and the bridge handed over its own XRP.

U.Today, a blockchain media outlet, reported on Aug. 11 local time that the attack lasted about 97 minutes, with the attacker bypassing the bridge’s verification process to steal about 200,000 XRP.

Soon after the incident, speculation spread on social media that the XRP Ledger’s “Rippling” function was abused in the attack. However, an investigation by XRPL analysis site xrpl.to found that the real cause lay in the bridge’s deposit verification process.

Native XRP has no issuer or trust line, making rippling technically impossible. A malicious withdrawal transaction that occurred during the attack was also approved through the bridge’s normal multisignature process, rather than using any abnormal function of the XRP Ledger itself.

The Coreum bridge operated by approving transactions once 17 signatures were collected from 28 relayer keys. The attacker did not steal any of those keys. Instead, the attacker targeted the fact that relayers did not properly check whether funds were actually deposited.

The attacker first moved the bridge-issued Wrapped-Core token between wallets under the attacker’s control. In the process, the attacker entered Coreum transfer information in the transaction memo. Because it looked like a normal transaction of the bridge’s own wrapped token, on-chain records alone could make it appear that an actual deposit had occurred.

The issue was how relayer operators verified transactions. They checked whether a transaction occurred and what was in the memo field, but they did not confirm whether the receiving address was the bridge’s deposit address. In other words, they checked that someone sent tokens, but not that the tokens actually entered the bridge.

Analysis found that the relayer code itself lacked a procedure to confirm whether funds had entered the bridge wallet. The attacker used this loophole to make a non-existent deposit be recognized as a valid one. As a result, the attacker was credited with a balance on the Coreum network for funds that had not actually been deposited.

When the attacker then requested a standard withdrawal, relayers judged it as normal. As 17 quorum signatures were gathered, about 200,000 XRP was sent from the bridge’s XRPL wallet to addresses controlled by the attacker.

xrpl.to assessed the incident as a case in which the bridge effectively trusted the attacker’s transactions blindly. It said the XRP Ledger did not provide funds directly to the attacker, but the bridge’s verification system believed a fake deposit and paid out real XRP.

The incident is also expected to weigh on the security management system of TX, the bridge operator. The security team previously built XRPL-based Sologenic and then launched its own layer-1 blockchain, Coreum. In March 2026, it integrated the two ecosystems under the U.S. brand TX.

TX has expanded its institutional blockchain business by emphasizing real-world assets (RWA). But because the incident appears to have involved the omission of a relatively basic cross-chain deposit verification procedure, criticism could grow over its quality control and security review systems.

So far, the TX team has not released an official post-incident analysis report. The Coreum bridge also remains fully suspended. As a result, debate over responsibility is expanding beyond a simple code bug to broader issues across development and security inspection systems.

The attacker’s identity has not been confirmed. On-chain activity has detected movements that appear to be attempts at money laundering, with the stolen XRP moving quickly through multiple intermediary wallets. Those wallets are assessed to have been created about 1.5 months before the attack.

Market attention is focused on an official incident report that TX may release. Key questions include how the bridge’s verification logic allowed the attack, whether further movement of the leaked XRP can be blocked, and when the bridge service will resume after security reinforcements.