On August 9, a bridge connecting the XRP Ledger and Coreum (now rebranded as tx) lost close to 200,000 XRP after an attacker tricked its deposit-checking system into treating a wallet-to-wallet transfer as a real deposit.<\/p>\n
The bridge has since halted, and both the operator and outside researchers have traced the failure to Coreum-side software rather than anything on the XRP Ledger itself.<\/p>\n
The first public warning came from a trader posting as playa, who flagged<\/a> that the bridge\u2019s XRPL account rxXXXeMX8Gy5YvibvGLnQJ1XKKD7UswM1, was bleeding funds and pointed to the account\u2019s DefaultRipple setting as the cause.<\/p>\n Playa said the balance had gone from 93,700 XRP to 77,200 XRP within minutes, a reading taken from an eleven-minute slice of what turned out to be a ninety-seven-minute drain.<\/p>\n Another user, Vet, pushed back in the same thread, writing that \u201cthe reason is the coreum bridge was being actively exploited.\u201d Playa later agreed, posting, \u201cI was rushing when I posted and didn\u2019t dig in properly.\u201d<\/p>\n The tx team confirmed<\/a> the exploit in a statement, saying its software \u201cincorrectly registered transactions that never actually delivered any XRP to the bridge.\u201d<\/p>\n A technical breakdown from Reza Bashash filled<\/a> in the mechanism: the attacker sent the bridge\u2019s own wrapped token between two of their own wallets, attached a bridge-deposit memo, and because the token is issued by the bridge, the transfer showed up in its history and was read as a genuine deposit.<\/p>\n Relayers approved it, unbacked assets were minted on the Coreum side, and the attacker withdrew real XRP against them. Bashash put the total at 198,715.88 XRP, converted to ETH, routed through THORChain, and ultimately sent to Tornado Cash.<\/p>\n The tx says the vulnerability has been identified, the bridge remains halted, and it has filed a report with the FBI\u2019s Internet Crime Complaint Center. No other bridged assets were affected, and the operator says a plan for compensating users is still being worked out.<\/p>\n A later on-chain review found<\/a> the same root cause from a different angle: 21 separate Coreum relayers each attested to the same phantom deposit, letting the attacker mint bridge assets with nothing backing them, then repeated the trick with escalating amounts before cashing out.<\/p>\n Every payout that followed on the XRPL Ledger carried a valid multisignature from the bridge\u2019s own relayer quorum, which is why the DefaultRipple explanation didn\u2019t hold up once the transaction data was checked. Native XRP has no trust line to ripple along in the first place, and the flag governs only the bridge\u2019s issued tokens.<\/p>\n The exploit landed while XRP was already sliding. The token sits near $1.02, close to a 21-month low, down roughly 4.4% this week as Bitcoin fell<\/a> to about $64,000 and the broader crypto market shed some $40 billion in a day.<\/p>\n The post Attacker Drains 200K XRP From Bridge Using Fake Deposit<\/a> appeared first on CryptoPotato<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" On August 9, a bridge connecting the XRP Ledger and Coreum (now rebranded as tx) lost close to 200,000 XRP after an attacker tricked its deposit-checking system into treating a wallet-to-wallet transfer as a real deposit. The bridge has since halted, and both the operator and outside researchers have traced the failure to Coreum-side software […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-212154","post","type-post","status-publish","format-standard","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/212154"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=212154"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/212154\/revisions"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=212154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=212154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=212154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}A Deeper Look, and a Market Already Under Pressure<\/h2>\n