An attacker drained 198,715.88 XRP from the Coreum XRPL bridge after exploiting a flaw in the bridge's relayer logic, according to incident reports. The theft stemmed from a vulnerability in how the bridge validated and processed deposits, not from any compromise of the XRP Ledger or XRP itself. Cross-chain bridges remain among the most targeted components in decentralized finance, with relayer verification flaws representing a recurring attack class that has led to some of the sector's largest losses.

Confirmed Details of the Exploit

The reported loss centers on a single figure: 198,715.88 XRP removed from the affected bridge. The incident involves the Coreum XRPL bridge, which connects the XRP Ledger to the Coreum network.

Reporting from CryptoPotato attributes the drain to a relayer logic flaw, describing how an attacker used a fake deposit to extract funds. Coverage from XRPL.to similarly attributes the loss to the bridge's relayer handling. The incident was previously reported as a loss of nearly 200,000 XRP.

The incident was publicly flagged and tracked, including by the txEcosystem account on X.

How the Relayer Flaw Enabled the Theft

A relayer is the off-chain component that monitors deposits on one blockchain and relays instructions so corresponding assets are released or minted on the other chain. In the Coreum bridge, this logic is handled in code that processes XRPL-to-Coreum transactions.

When a relayer accepts a deposit as valid without fully verifying it, an attacker can trick the bridge into crediting funds that were never genuinely deposited. This category of vulnerability — where the bridge's off-chain logic trusts state from one chain without sufficient independent confirmation — has been responsible for multiple high-profile bridge incidents across the industry. The available reporting attributes the loss to this type of relayer flaw, though the precise exploit path beyond the fake-deposit description has not been fully detailed.

Bridge mechanics can also interact with XRP Ledger features such as rippling on fungible tokens, which governs how balances move through trust lines. The exact technical chain of events should be treated as still developing.

Broader Context for Cross-Chain Security

The stolen asset is XRP, but bridge exploits of this nature affect user trust in cross-chain infrastructure broadly rather than reflecting on any single token's design. Bridges connect isolated blockchains so assets can move between networks, but this interoperability layer has proven consistently vulnerable because it introduces off-chain trust assumptions that smart contracts alone cannot enforce. Similar security concerns arose following the SYND bridge exploit, which resulted in a $380K loss, and the multi-chain exploit at Wasabi Protocol, both of which raised questions about bridge security.

Affected bridge operators typically face decisions about pausing the bridge, pursuing fund recovery through forensic tracking, and whether to compensate affected users — areas where further Coreum disclosures will clarify the project's response.

As this is an ongoing situation, further disclosures may clarify the scope, remediation, or recovery status. The details above reflect only what current reporting supports.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always conduct your own research before making decisions.