The Coreum bridge held about 200,410 XRP on August 9. Ninety-seven minutes later it held 493. An attacker drained 199,916 XRP from the cross-chain bridge across 94 separate withdrawals, emptying 99.7% of the reserve before anyone paused it. In dollars, the haul came to roughly $202,000. That figure matters, because most of this week's coverage did not lead with it.
The bug lived in a memo
The exploit never touched the XRP Ledger. It touched the software watching it. Relayers running the Coreum bridge scanned the bridge account for incoming payments that carried a memo naming a recipient on the Coreum chain, then minted bridged XRP against those deposits. They never verified that the payment had actually delivered any XRP. So the attacker submitted transactions with valid-looking memos and nothing real behind them, and the independent operators all running the same code signed off in unison. On-chain analysts counted 17 of the 28 relayer keys authorizing the fraudulent withdrawals.
Bridges break this way more often than their audit trails admit. TX, the brand that absorbed Coreum in February, said the bridge had passed several internal and third-party reviews before launch. It has since filed a complaint with the FBI and confirmed the uncomfortable part: bridged XRP on its chain is no longer fully backed. The same shape showed up when a trading vault emptied in six minutes and when a Coinsbuy refund stalled at half the stolen $8 million. The code did what it was told, not what it should have.
A $202,000 drain did not push XRP under a dollar
XRP slipped below $1 on August 11 for the first time since November 2024, touching about $0.99 before buyers dragged it back near $1.02. Several outlets pinned the slide on the Coreum bridge hack. The math does not cooperate. XRP futures open interest sat at $2.73 billion, the highest since October 2025, with roughly 2.67 billion XRP in notional exposure stacked at the $1.00 line. When price pierced that level, more than $11 million in long positions liquidated in one session. Funding rates jumped 211% in a day. July inflation, released the same week, printed exactly on the 3.4% consensus and moved nothing.
The stacked longs explain the price. A $202,000 loss does not move a token that changes hands in the billions daily, however loud the headline. Here is what the two events actually weighed.
| Figure | Value |
|---|---|
| XRP drained from the Coreum bridge | 199,916 (about $202,000) |
| XRP left in the bridge | 493 |
| Share of the reserve lost | 99.7% |
| XRP futures open interest | $2.73 billion |
| Long positions liquidated under $1 | Over $11 million |
| 24-hour funding rate change | Up 211% |
The split is worth drawing cleanly. No XRPL private key was compromised, and no XRP holder outside the bridge lost a coin. The damage sat entirely inside third-party relayer software, which is precisely why the broader market shrugged it off and took its orders from the futures book rather than the exploit.
Where the XRP went
The stolen funds did not sit still. On-chain tracking shows the XRP routed through THORChain, swapped into assets on Ethereum, and pushed toward Tornado Cash, the standard path for a thief who wants to cut the trail early. That speed, paired with the clean memo trick, points to someone who studied the relayer logic rather than stumbling into it. It rhymes with an earlier case, when an XRP staking scam took $8.5 million and police traced $19 million across connected wallets.
Coreum has not published a full incident report or a plan to make bridged holders whole. Until it does, anyone holding bridged XRP on that chain is holding a claim on 493 coins and a promise. The broader XRP market will keep taking its cue from the $2.73 billion of open interest, not from a bridge that lost the price of a used car.
