On August 9, the Coreum–XRP Ledger bridge paid out 199,916 XRP across 94 transactions in 97 minutes. The bridge had custodied roughly 200,410 XRP. When the draining stopped, 493.5 XRP were left — about 99.7% of the reserve gone.
The flaw was mundane, which is the worrying part. The relayer software watched the bridge account’s history for payments carrying a Coreum recipient memo, but never verified the payment’s destination. A valid-looking memo was attached to transactions pointing at the attacker’s wallet, and the relayers — each signing with a majority of their own signatures — released real XRP against deposits that never arrived.
TX, the company behind Coreum and Sologenic, confirmed the incident, halted the bridge, acknowledged that bridged XRP on its chain is not currently fully backed, and said it has filed a complaint with the FBI. XRP briefly traded below $1 on Tuesday for the first time since November 2024.
The other half: the ETF bid stopped showing up
US spot XRP ETFs took in $1.01 million in the week ended August 8, down from $14.86 million the week before — a 93% drop. Net assets slipped to $964.21 million from $988.78 million. The compression has been running for months: weekly inflows peaked at $60.50 million in mid-May, then stepped down through $22.04 million, $15.20 million, $14.86 million, $8.15 million and $1.01 million. Flows were flat across the first two sessions of this week, per SoSoValue data.
On-chain, the picture is the opposite. Active XRP addresses climbed from 23,642 to 43,543 between August 1 and mid-month, an 84% jump, according to analyst Ali Martinez. Santiment counted 32 additional wallets holding at least a million XRP over the past three months. Usage up, wrapper demand near zero.
Our take: The bridge that broke was not Ripple’s. It was a third party’s connector into the XRP Ledger, and that distinction matters legally and not at all commercially. Institutions underwriting XRPL settlement price the whole surface area — ledger, bridges, custodians, relayers. A five-figure token loss is rounding-error money; a relayer that never checked a destination address is a diligence finding. And it landed in the same fortnight that the ETF channel, the cleanest read on allocator demand, went to roughly nothing. An exchange-traded wrapper does not fix infrastructure. It just makes it easier to stop buying.
What to watch
- Whether TX makes bridged holders whole, and on what timeline. Unbacked bridged supply is a live liability, not a closed incident.
- Relayer audits. Whether XRPL-adjacent bridges publish independent reviews of deposit verification logic — the exact thing that failed here.
- The next weekly ETF flow print. Six consecutive weeks of compression is a trend; a seventh makes it a regime.
- Washington. The CLARITY Act timetable and the SEC’s own exemption push both change what regulated allocators are permitted to hold.
Ripple has spent two years building the institutional case for the ledger — custody, payments, RLUSD, tokenization. None of that is undone by one third-party bridge. But the people writing the allocation memos read incident reports, and this one reads badly.