Coreum XRPL Bridge Exploit (August 2026)

2026-02-17

Coreum and Sologenic communities announce merger into tx, a U.S.-based real-world asset tokenization platform. COREUM and SOLO tokens begin migration to a unified TX token. The XRPL bridge continues operating.

2026-08-09

At approximately 17:34–17:57 UTC, the attacker creates two new XRPL wallet addresses, later used to receive stolen funds.

2026-08-09

At 19:16 UTC, the attacker submits the first fraudulent deposit memo, triggering the bridge's relayer network to authorize XRP withdrawals against an unbacked balance.

2026-08-09

Between 19:16 and 20:53 UTC (97 minutes), the attacker executes 94 separate multisig-authorized XRP payments totaling 199,916.3 XRP, draining the bridge reserve from approximately 200,410 XRP to approximately 493.5 XRP.

2026-08-09

Stolen XRP begins moving through multiple intermediate wallets within hours of the drain. On-chain analysis indicates transit wallets used to disperse funds were created approximately 1.5 months prior to the attack.

2026-08-11

tx publicly confirms the exploit, announces the bridge is halted, states the vulnerability has been patched, discloses engagement of blockchain forensics specialists, and confirms an FBI Internet Crime Complaint Center (IC3) complaint has been filed. tx acknowledges that bridged XRP on the tx chain is not currently fully backed.

2026-08-11

XRP price falls below $1.00 intraday, touching approximately $0.9905 — its first sub-$1 level since January 2024 — before recovering to close around $1.01. Multiple outlets link the decline in part to sentiment from the bridge exploit.

2026-08-13

As of this date, tx has not published a formal post-mortem report and has not announced a plan to compensate users holding unbacked bridged XRP. The bridge remains paused.