XRPL-TX Bridge August 2026 XRP loss
Independent reproducible on-chain analysis supports a gross 199,916.3 XRP outflow from the XRPL-Coreum / current XRPL-TX Bridge through 94 successful outgoing payments over about 87 minutes on August 9, 2026. A broader approximately 97-minute activity window includes preceding wrapped-TX activity and is not used as the duration of the XRP-only drain. Current public relayer source code contains a validation path consistent with the reported relayer-logic hypothesis, but BIR does not treat that code observation or the independent reproduction as tx/Coreum first-party proof of the production exploit path.
Incident facts
- Incident title
- XRPL-TX Bridge August 2026 XRP loss
- Bridge
- XRPL-TX Bridge
- Incident date
- 2026-08-09
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- XRP Ledger, TX Chain
- Affected assets
- XRP
- Attack category
- Unknown
- Reported loss
- 199,916.3 XRP were independently reproduced as the gross total of 94 successful outgoing XRP payments over about 87 minutes.
- Amount confidence
- Medium
- Loss amount basis
- Reported By News
- Recovery
- Unknown
- Reimbursement
- Unknown
- Restart
- Paused
- Current outcome
- Unknown
- Postmortem
- Not Found
- Resolution
- Unresolved
- Last reviewed
- 2026-08-23
- Last verified
- 2026-08-23
Amount and valuation
199,916.3 XRP were independently reproduced as the gross total of 94 successful outgoing XRP payments over about 87 minutes.
The 199,916.3 XRP gross outflow is now independently reproduced from public XRPL queries. A lower 198,715.88 XRP figure attributed to tx technical leadership remains unreconciled in review authority and is not silently substituted. No USD value is canonicalized without a sourced valuation basis.
199,916.3 XRP reported transferred out in 94 payments
Contemporaneous secondary report summarizing on-chain analysis; no unsourced USD conversion is added.
199,916.3 XRP gross outgoing total across 94 successful payments
Independent reproducible XRPL analysis; the XRP-only payment window is about 87 minutes.
Why this remains unresolved
- No first-party TX/Coreum incident postmortem, recovery statement, reimbursement statement, or reopening statement was located at the 2026-08-12 review point.
- The exact production exploit path has not been established by an admitted first-party incident source.
- Final recovery and bridge restart outcomes remain unknown.
Timeline events
XRPL-TX Bridge loses XRP and is reported halted2026-08-09
Independent reproducible XRPL analysis supports 199,916.3 XRP leaving the bridge through 94 successful outgoing payments over about 87 minutes on August 9, 2026. A broader approximately 97-minute activity window includes preceding wrapped-TX activity. Contemporaneous reporting described the bridge as halted after the incident. BIR keeps the production root cause provisional because direct tx/Coreum first-party incident authority has not yet been admitted.
The gross XRP outflow and 94-payment sequence are independently reproducible. The 94 XRP payments themselves span about 87 minutes; the broader 97-minute activity window includes preceding wrapped-TX activity. The pinned first-party relayer source remains technical context only and does not independently prove the production exploit path.
Evidence records
- XRPL-to-Coreum relayer incoming-transaction processCoreumFoundation · Tier 1 · High reliability · primary · 2025-09-05Claim scope: Incident Case
Pinned first-party technical artifact. The reviewed incoming-payment path checks final/successful Payment transactions, decodes the bridge memo, reads DeliveredAmount, and submits transfer evidence while no explicit payment Destination equality check against BridgeXRPLAddress is visible in that branch. This supports a verification-gap hypothesis but does not prove that the August 9 production exploit used this exact path.
- XRP bridge loses 200K XRP after relayer logic flawcrypto.news · Tier 2 · High reliability · secondary · 2026-08-11Claim scope: Incident Case
Contemporaneous secondary report summarizing on-chain analysis: 199,916.3 XRP left the bridge through 94 payments over 97 minutes; withdrawals carried 17-of-28 relayer signatures; the bridge was halted. Its relayer-logic explanation remains a hypothesis in BIR until first-party incident evidence establishes the production root cause.
- Coreum Bridge $200K Exploit: 17 Signers and One Missing Destination CheckSigIntZero · Tier 2 · High reliability · secondary · 2026-08-18Claim scope: Amount
Independent reproducible XRPL analysis supporting 94 successful outgoing XRP payments, a gross total of 199,916.3 XRP, an approximately 87-minute XRP-only drain window, no inbound bridge payments during that window, and the observed 17-of-28 signer configuration. It corroborates the public relayer verification-gap hypothesis but is not tx/Coreum first-party incident authority and does not establish recovery, reimbursement completion, reopening, or the exact production relayer build.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- Whether the missing destination-address check visible in the reviewed relayer path was the exact production root cause is not established by admitted first-party incident authority.
- Relayer-key compromise is not established; the observed 17-of-28 signature pattern is not treated as proof that private keys were stolen.
- A later 198,715.88 XRP figure attributed to tx technical leadership remains unreconciled against the independently reproduced 199,916.3 XRP gross reserve outflow.
- Recovery, reimbursement, reserve-restoration completion, and reopening status remain unverified.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.