200,000 XRP Lost in 97 Minutes: Who's to Blame?

utoday08-11 08:54

Two days after the incident, it emerged that the Coreum cross-chain bridge lost around 200,000 XRP during a 97-minute attack. Initial theories on social media linked the incident to a vulnerability in...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2658492911?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-11 08:54","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2658492911","market":"other","top_or_hot":-1,"title":"200,000 XRP Lost in 97 Minutes: Who's to Blame?","media":"utoday","content":"<div>\n<p>Two days after the incident, it emerged that the Coreum cross-chain bridge lost around 200,000 XRP during a 97-minute attack. Initial theories on social media linked the incident to a vulnerability in...</p>\n\n<a href=\"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame\">Source Link</a>\n\n</div>\n","source":"utodaynews_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>200,000 XRP Lost in 97 Minutes: Who's to Blame?</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\n200,000 XRP Lost in 97 Minutes: Who's to Blame?\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-11 08:54 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame><strong>utoday</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Two days after the incident, it emerged that the Coreum cross-chain bridge lost around 200,000 XRP during a 97-minute attack. Initial theories on social media linked the incident to a vulnerability in...</p>\n\n<a href=\"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"XRPI","symbol_name":"1倍XRP ETF-Volatility Shares","start_time":0,"source_url":"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame","article_id":"2658492911","we_media_id":null,"thumbnails":[],"rights":{"source":"utodaynews_highlight","url":"https://u.today/200000-xrp-lost-in-97-minutes-whos-to-blame","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2658492911","pubTimestamp":1786409640,"columns":[],"sourceInfo":{"source_id":"utodaynews_highlight","name":"u.today"},"weMediaInfo":null,"summary":"At the time of writing, the TX team had still not released an official post-mortem report. The Coreum bridge remained completely suspended.The hacker's identity remains unknown, but on-chain trackers are already seeing a classic attempt to cover their tracks. The stolenXRP is being rapidly distributed through a chain of transit wallets that were created a month and a half before the attack.","collect":0,"end_time":0,"defaultTopTitle":"u.today","property":[],"viewcount":null,"language":"en","relate_stocks":{"XRPI":"1倍XRP ETF-Volatility Shares","XRPK":"T-REX 2x Long XRP Daily Target ETF","XRPT":"2倍杠杆XRP ETF-Volatility Shares","XRPC":"Canary XRP ETF","TOXR":"21shares XRP ETF","BK4099":"汽车制造商","BITW":"Bitwise 10 Crypto Index ETF","XRPZ":"Franklin XRP ETF","XXRP":"2倍做多XRP ETF-Teucrium","UXRP":"Proshares Ultra XRP ETF","SOLO":"Electrameccanica Vehicles Corp.","XRPR":"REX-OSPREY XRP ETF","XRP":"Bitwise XRP ETF"},"translate_title":"97分钟内损失20万XRP：谁该为此负责？","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"XRPI":1.5,"XRPR":0.6,"XRPC":1.5,"TOXR":1.5,"XRP":1.5,"SOLO":1,"BITW":1.5,"XRPK":0.6,"XRPT":1.5,"XXRP":1.5,"XRPZ":1.5,"UXRP":1.5},"content_text":"Two days after the incident, it emerged that the Coreum cross-chain bridge lost around 200,000 XRP during a 97-minute attack. Initial theories on social media linked the incident to a vulnerability in the XRP Ledger's \"rippling\" function. However, an analytical report from xrpl.to showed that the bridge effectively robbed itself by blindly trusting the attacker's transactions.How 200,000 XRP got lostNative XRP has no issuer or trust lines, so rippling is technically impossible for it. Moreover, every malicious payment was signed using the bridge's own legitimate multisignature, with a quorum of 17 out of 28 relayer keys, or validators. The hacker did not compromise the keys but simply created the illusion of a deposit for the validators.First, the attacker moved their own wrapped tokens, or wrapped-CORE, between wallets they controlled, with a memo containing transfer details for Coreum attached to these transactions. Because the wrapped tokens had been issued by the bridge itself, the transfers appeared in its transaction history without any problems. Transaction mechanism analysis of the Coreum bridge exploit on the XRP Ledger, Source: xrpl.toThis was where the system's blind spot came into play. The relayer operators checked only whether a transfer had occurred and what was written in the memo field, while completely ignoring the recipient address. A check confirming that the funds had actually been sent to the bridge's wallet had simply never been added to the relayer code.As a result, Coreum accepted the fake deposits and credited the hacker with a balance on its network. The attacker then requested a regular withdrawal, and the validators signed the transactions sending 200,000 real XRP from the bridge's XRPL wallet without hesitation.The team responsible for the bridge's security has a long history of rebranding. It initially created the Sologenic (SOLO) project on the XRPL, then launched its own Layer 1 blockchain, Coreum, and in March 2026 merged both ecosystems under the U.S. brand TX, focused on the tokenization of real-world assets (RWAs).The fact that a regulated U.S. company claiming institutional status could make such a basic mistake in its cross-chain verification logic damages TX's reputation more than the amount lost. It moves the question of who is to blame from the realm of a random bug to that of systemic quality control within the company.What is happening to the tokens now?At the time of writing, the TX team had still not released an official post-mortem report. The Coreum bridge remained completely suspended.The hacker's identity remains unknown, but on-chain trackers are already seeing a classic attempt to cover their tracks. The stolen XRP is being rapidly distributed through a chain of transit wallets that were created a month and a half before the attack.","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.1","shortVersion":"4.47.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2658492911","isCrawlerRequest":true}