Coreum Bridge Exploited: Nearly 200,000 XRP Stolen in Validation Attack

On August 9, 2024, the Coreum cross-chain bridge suffered a significant security breach resulting in the unauthorized withdrawal of nearly 200,000 XRP. The incident, which took place over a span of approximately 97 minutes, saw the bridge's liquidity drained through a series of rapid transactions. While the underlying blockchain infrastructure remained secure, a specific vulnerability in the bridge's relayer logic allowed an attacker to siphon funds, leading to an immediate suspension of the service.

Mechanism of the 94-Transaction Exploit

The attack began on August 9 and involved 94 individual transactions. During this window, the bridge's XRP balance plummeted from roughly 200,410 XRP to a mere 493.5 XRP. Technical analysis indicates that the attacker did not gain access to private keys or compromise the XRP Ledger (XRPL) itself. Instead, the breach targeted the validation process of the cross-chain bridge.

• The attacker utilized forged deposit operations that the system incorrectly identified as legitimate.
• The bridge's relayer logic failed to distinguish between these fabricated entries and genuine user activity.
• This failure triggered automatic XRP payments from the bridge’s main wallet to the attacker’s destination addresses.

Architectural Vulnerabilities and Service Suspension

The Coreum bridge was officially launched on March 20, 2024, with the primary objective of connecting the XRP Ledger to over 110 IBC-compatible chains ((Inter-Blockchain Communication protocol)). Experts suggest the core issue stemmed from a design preference for relayer-based validation over more secure on-chain cryptographic proofs. By relying on the relayer to verify transaction validity off-chain, the system became susceptible to the logic manipulation used in this exploit.

As of August 11, the Coreum bridge remains suspended to prevent further losses and allow for a comprehensive security audit. While the team has acknowledged the incident, a formal, detailed report outlining the technical fixes and potential compensation for affected liquidity providers has yet to be released.

The exploit highlights the persistent risks associated with cross-chain interoperability, particularly when decentralized validation methods are bypassed for speed or simplicity. For users of Cosmos-based ecosystems and the XRPL, this event serves as a reminder of the critical importance of cryptographic rigor in bridge architecture. Security researchers continue to monitor the movement of the stolen 199,916 XRP as the community awaits an official post-mortem from the Coreum developers.