Coreum bridge exploit drains 200,000 XRP, TX faces scrutiny over security gap

Security flaw exposes Coreum bridge

Initial discussion on social media focused on a potential vulnerability in the XRP Ledger’s “rippling” feature, which some believed may have played a role in the breach. However, further analysis revealed that this theory did not account for the root cause of the exploit.

Experts explained that native XRP does not rely on trust lines or issuers, meaning the “rippling” functionality cannot be applied to it. Instead, the bridge processed every malicious transaction using its own multisignature mechanism, requiring approval from 17 out of 28 validators.

Native XRP lacks trust lines, so rippling does not affect it. Instead, every rogue withdrawal was processed through the bridge’s legitimate multisignature workflow, signed by the required quorum of validators without compromise.

How the exploit worked

The attacker initiated the breach by transferring wrapped tokens, referred to as wrapped-CORE, between wallets under their control. These transactions included memos detailing transfer instructions for Coreum. Since the bridge itself had issued the wrapped tokens, the movements appeared legitimate in transaction logs.

A key vulnerability allowed the exploit to succeed. The relayer operators, responsible for validating transactions, checked only whether a transfer took place and what was written in the memo field. Critically, they did not verify whether the assets were actually sent to the bridge’s wallet address.

Without this check in place, the attacker could convince the bridge to credit fake deposits. They then requested a standard withdrawal, prompting the validators to sign and send the actual XRP funds—totaling 200,000 XRP—to the hacker’s address on the XRPL, all through the legitimate transaction process.

Company background and fallout

The security team behind the affected bridge previously launched the Sologenic (SOLO) project on the XRP Ledger and later unveiled their own Layer 1 blockchain, Coreum. In March 2026, these platforms were merged into TX, a US-based company specializing in the tokenization of real-world assets (RWAs).

Mini dictionary: TX is a US-based blockchain company that emerged from the merger of Sologenic and Coreum, focusing on tokenizing real-world assets (RWAs).

Industry observers warn that the true damage to TX may lie not in the stolen amount, but in the apparent lapse in cross-chain verification procedures—an oversight considered fundamental for a regulated entity that promotes itself as an institutional-grade platform.

This occurrence highlights a systemic weakness in quality control rather than an isolated software bug, calling into question the robustness of the company’s risk management standards.

As of publication, TX had not released a detailed post-mortem about the incident. The Coreum cross-chain bridge remained offline in response to the breach.

Aftermath and ongoing investigation

The perpetrator’s identity continues to elude investigators. However, blockchain tracking services have observed the stolen XRP being distributed across numerous intermediary wallets, a common tactic designed to obfuscate the transaction trail.

The attacker reportedly set up the series of transit wallets used to move the funds about six weeks prior to the exploit, suggesting a degree of planning. At the time of writing, coin holders and the broader community awaited further updates from TX regarding potential recovery efforts and improvements to security protocols.