XRP Falls Below $1 After Coreum Hack

The Happenings

On August 9, an attacker intruded the Coreum bridge, the main infrastructure that allows users to secure XRP on the XRP Ledger and receive an equivalent bridged version on Coreum.

The bridge held approximately 200,410 XRP before the attack started at 19:16 UTC. And in the next 97 minutes, the attacker had implemented 94 payments running a total of 199,916 XRP, leaving the bridge with about 493.5 XRP, almost a loss of 99.7% of its reserve.

The mechanics put in place were simple. The bridge’s relayer software scanned transaction history for payments that came carrying a particular Coreum memo and approached that memo as proof a deposit had been implemented, without ever confirming the payment  got to the correct wallet.

The attacker took advantage of that gap by moving tokens between two wallets they were in charge of and linking a Coreum-formatted memo. The software perceived it as a legitimate deposit and credited the attacker accordingly. Hence, no keys stolen, no protocol broken, just a faulty verification assumption. A quorum of 17 out of 28 relayer keys approved each payment, precisely as designed, but with false evidence.

When the fake balance appeared, the attacker went on to withdraw real XRP via the bridge’s normal process, siphoning proceeds via Tornado Cash and onward to staging wallets in a recognized laundering pattern.

The Price Reaction

The news spread like wildfire, and XRP, that was already having a rough year, broke below the $1 level on August 11 for the first time ever, since November 2024. The token reached an intraday low near $0.99 before buyers stepped in, and pushed it a bit to $1.01. By August 13, XRP was trading at $0.9998–$1.01 band, essentially defending the $1.00 level it had held the greater part of the year.

Context matters: XRP’s slide precedes this hack by months. The token stands approximately 70% below its 2025 all-time high near $3.30, and it had already dropped more than 40% from its January 2026 peak before this intrusion added fresh selling pressure on top of an ongoing downtrend.

It wasn’t a Ledger Failure

The crucial distinction here got lost in early panic: the XRP Ledger itself wasn’t interfered with No validator was breached, no private keys were stolen, and native XRP holders who never touched the Coreum bridge didn’t encounter any direct risk. The failure only existed in Coreum’s third-party relayer software, an extra layer built on top of the ledger, so not the ledger’s own consensus or security model.

That distinction details why cross-chain bridges continue showing up in exploit headlines industry-wide. Bridges typically make trust assumptions about verification logic that base-layer blockchains don’t, and when that logic comes with a small bug, the complete security model built on top of it is at risk. This year alone has seen similar logic-level exploits elsewhere in crypto, therefore fortifying that bridges are one of the industry’s most relentless vulnerabilities.

TX’s Acknowledgement

TX, the company in charge of Coreum and Sologenic, acknowledged the incident, crediting it to a bug in the XRPL relayer logic in conjuction with the XRP Ledger’s DefaultRipple feature.

Notably, the company also revealed bridged XRP on its chain is not currently fully backed; a big disclosure, since holders of bridged XRP on Coreum are exposed to a shortfall until reserves are restored. TX said it has proceeded to filed a complaint with the FBI, and the bridge is suspended in the days following the attack.

Why This Incident matters

$200,000 is small by 2026’s exploit standards, and the muted price recovery indicates traders predominantly read this correctly, a bridge-layer failure, not a threat to XRP holders at a wider scope. However, the psychological outcome surpassed the dollar figure.

Breaking below $1 is a symbolic line for a token attached to that number in investor psychology for years, and the timing didn’t help at all.

The reaction from bigger holders showcases a different narrative than the headline price action, though. Even as XRP dipped below $1, on-chain data indicated 32 new wallets amassing at least one million XRP each around the exploit, and daily active addresses rose approximately 35% in August versus July.

That disparity, falling price along with rising large-holder accumulation, indicates some serious market players are perceiving the dip as a buying opportunity as opposed to a reason to exit.

Conclusion

The Coreum bridge hack didn’t break the XRP Ledger, and it come anywhere near to jeopardize XRP’s core security model, however it broke through a psychologically crucial price level at a time when the token was under immense pressure, adding another data point to a long standing pattern of cross-chain bridges being cryptocurrency’s most vulnerable infrastructure layer.

Whether XRP holds $1 going forward depends less on this incident than on how the broader token trades in the rest of the year, however TX’s admission that bridged XRP isn’t fully backed is a loose end worth watching out for users holding bridged tokens and on Coreum particularly.

This is a developing story. We’ll update this piece as TX releases further details on reserve restoration and any recovery of stolen funds.