Coreum bridge loses 99.7% of XRP reserve in $200K exploit
An attacker drained 99.7% of the XRP reserve backing the Coreum cross-blockchain bridge on August 9 by conjuring fake evidence of deposits that fooled the bridge’s own operators into authorizing real withdrawals.
Nobody stole anyone’s private key to execute the clever hack. Instead, Coreum’s bridge liquidity account paid out 199,916 XRP worth over $200,000 across 94 transactions, each one carrying a majority of signatures from its own relayers.
Hours later, Coreum was shocked to discover it held just 493 XRP worth roughly $500.
A memo was all Coreum’s bridge required
The relayer software watched the bridge account’s history for payments carrying a Coreum recipient memo.
It never verified that payment destination. A seemingly valid memo existed, yet the destination was the hacker’s wallet.
Ostensibly independent operators reached identical conclusions and signed off on all of the withdrawals because they were all running the same buggy code.
Read more: XRP Ledger generated less than $400 in fees yesterday
… Continue reading the full article at the original source below.
