How a Bridge Robbed Itself: The 200,000 XRP "Phantom Deposit" Exploit
Cross-chain infrastructure remains one of the highest-risk sectors in decentralized finance. In August 2026, the Coreum cross-chain bridge suffered a severe exploit, losing 200,000 XRP in a span of just 97 minutes.
While initial speculation pointed toward vulnerabilities in the XRP Ledger's "rippling" features, security analysis revealed a far simpler—and more alarming—reality: the bridge essentially robbed itself by blindly trusting transaction memo data without verifying the deposit address.
The Technical Breakdown: How the Exploit Happened
The attack did not involve stolen private keys, broken multisignature quorums, or zero-day cryptographic bugs. In fact, every single malicious payout was legitimately signed by the bridge's validators using a valid 17-of-28 multisignature quorum.
So how did the attacker manipulate the protocol into giving away 200,000 real XRP?
[ Attacker Wallet A ] ---> (wrapped-CORE transfer with Memo) ---> [ Attacker Wallet B ] | Relayers inspect Memo ONLY (Ignore Recipient Address) | [ Bridge Believes Deposit Occurred ] | [ Attacker Requests Real XRP Withdrawal ] | [ 17/28 Validators Legally Sign Payout from XRPL Wallet ]
The attacker began by moving their own wrapped tokens (wrapped-CORE) between two wallets under their control. Because these wrapped assets had been issued on-chain by the bridge platform itself, these internal transfers showed up in the bridge’s transaction history.
In the transfer payload, the attacker attached a custom memo containing bridge processing details. The relayer nodes monitoring the network checked two things:
Did a transaction occur? Yes.
Was there a valid memo string attached? Yes.
However, the relayer software never verified whether the recipient address was actually the bridge's treasury wallet. The funds simply moved from the attacker's Wallet A to the attacker's Wallet B.
Because the relayer software falsely registered a successful deposit, it credited the attacker's account on the target chain. The attacker immediately requested a legitimate withdrawal. Seeing a "valid" deposit record, 17 out of 28 relayer nodes signed off on the request, transferring 200,000 real XRP directly out of the bridge’s main wallet on the XRP Ledger.
Key Security Takeaways
This incident reinforces a fundamental principle of smart contract and off-chain relayer architecture: never separate transaction detection from state verification.
Validate Recipient & Balance: Off-chain relayers and indexing bots must verify not only that a transaction succeeded, but that the exact protocol vault address received the exact intended asset.
Defense in Depth: Multisig validator nodes are useless if all validators run flawed code that auto-signs without cross-checking state changes.
Fake Deposit Testing: Bridge operators must subject off-chain logic to simulated false top-up scenarios prior to mainnet deployment.
Upgrade Your Security Skills at Our Academy
As cross-chain architectures grow in complexity, relying solely on basic code reviews is no longer enough. Off-chain infrastructure, indexer logic, and validator relayers represent massive attack surfaces.
Want to learn how to audit decentralized systems and defend protocols against logic exploits? Join us at our upcoming Security Academy! What You Will Learn:
Relayer & Indexer Auditing: How off-chain daemons parse block data and avoid blind trust loopholes.
On-Chain Forensics: Tracking exploit flows across bridges, DEXs, and multisig setups.
Rigorous Verification Patterns: Implementing multi-confirmation mechanisms and exact balance-change checks.
Cyber Hygiene for Investors: Identifying risky bridge architectures before bridging high-value assets.
Don't wait for the next bridge vulnerability. Reserve your spot at our academy today!