tx XRPL bridge (formerly Coreum) hack — August 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | August 11, 2026 |
| Target type | Cross-chain bridge |
| Loss | $202,000Published estimates range $200,000 to $202,000Price at time of incident |
| Method | Contract logic errorThe relayers' deposit-detection logic accepted transactions that delivered no XRP as real deposits, minting unbacked bridged XRP that was redeemed against the reserve |
| Chains | XRP Ledger, Other |
| Outcome | Unresolved |
What happened
The bridge connecting the XRP Ledger to the tx chain — the network formed when Coreum merged with Sologenic and rebranded in March 2026 — was drained of almost its entire reserve on 9 August 2026. Between 19:16 and 20:53 UTC the XRP held against bridged balances fell from about 200,410 to 493.5, a loss of roughly 199,916 XRP worth about $202,000 at the time.
The flaw was in how the bridge decided a deposit had happened. Its relayers registered transactions that never actually delivered XRP as genuine deposits and minted bridged XRP on the tx chain against them; the attacker then redeemed that unbacked balance for real XRP from the reserve wallet. It took 94 separate withdrawals, each signed off by 17 of the 28 relayer keys.
The signing threshold is worth stating precisely, because the keys were never stolen and the relayers behaved exactly as designed. They were authenticating a fact the software had got wrong, which is why a majority-signature scheme offered no protection here.
tx said on 12 August that it had halted the bridge, corrected the affected code, traced the funds and filed a complaint with the FBI's Internet Crime Complaint Center. It has not said how holders of the now-unbacked bridged XRP will be made whole. No attribution has been established.
Sources
- DecryptSecondary · retrieved 2026-08-13
- CoinDeskSecondary · retrieved 2026-08-13
- The Crypto TimesSecondary · retrieved 2026-08-13
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "tx XRPL bridge (formerly Coreum) hack — August 2026", iTokenly, accessed 2026-08-13, https://itokenly.com/hacks/tx-xrpl-bridgehttps://itokenly.com/hacks/tx-xrpl-bridgePermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.