Attacker Drains 200K XRP From Bridge Using Fake Deposit

On August 9, a bridge connecting the XRP Ledger and Coreum (now rebranded as tx) lost close to 200,000 XRP after an attacker tricked its deposit-checking system into treating a wallet-to-wallet transfer as a real deposit.

The bridge has since halted, and both the operator and outside researchers have traced the failure to Coreum-side software rather than anything on the XRP Ledger itself.

What Happened, and How the Alarm Went Out

The first public warning came from a trader posting as playa, who flagged that the bridge’s XRPL account rxXXXeMX8Gy5YvibvGLnQJ1XKKD7UswM1, was bleeding funds and pointed to the account’s DefaultRipple setting as the cause.

Playa said the balance had gone from 93,700 XRP to 77,200 XRP within minutes, a reading taken from an eleven-minute slice of what turned out to be a ninety-seven-minute drain.

Another user, Vet, pushed back in the same thread, writing that “the reason is the coreum bridge was being actively exploited.” Playa later agreed, posting, “I was rushing when I posted and didn’t dig in properly.”

… Continue reading the full article at the original source below.