An attacker drained nearly 200,000 XRP from the Coreum cross-chain bridge on August 9 by exploiting a flaw in the bridge's relayer code that verified transaction memos but not payment recipient addresses, according to on-chain records.
The attack took 97 minutes and moved 199,916.3 XRP in total. The relayer logic allowed an attacker to create fake balance records by specifying unverified payment destinations, then trigger real withdrawals against those fabricated balances. Coreum had not published an official incident report as of August 11.
Cross-chain bridges operate by locking assets on one blockchain and minting representative tokens on another. The Coreum bridge uses a relayer system to confirm deposits on the source chain before releasing funds on the destination. The relayer checks that transaction memos match expected values but, according to the attack pattern, failed to validate the actual recipient address field. This gap let the attacker post false deposit records without controlling the corresponding funds.
The 199,916 XRP represents the total drained in a single coordinated sequence rather than multiple smaller transactions. The attacker had pre-positioned the exploit and executed it in one window, completing the entire drain in less than two hours.
XRP exists across multiple blockchains and uses bridges to move between them. Coreum is an XRP Ledger sidechain focused on asset issuance and smart contracts. Bridge security depends on relayer integrity, since the relayer sits between two separate ledgers and can create tokens on one side without corresponding collateral on the other if its verification logic contains gaps.
Bridge exploits have occurred at other protocols. Relayers that verify memos but not addresses leave a class of attacks available to anyone who can craft the right transaction structure.
Coreum's failure to validate payment recipient addresses before authorizing withdrawals allowed an attacker to drain the bridge in under two hours. A basic recipient field check would have blocked the mechanism. The 199,916 XRP loss is material enough to warrant a full audit of relayer permissions and deposit verification across similar bridge systems.
