XRP slips below $1 after bridge hack

TLDR

XRP fell below $1 after an exploit drained about 200,000 XRP from the Coreum cross-chain bridge, but the flaw was in the bridge code, not in the XRP Ledger itself.

1. An attacker drained nearly all of the XRP in the Coreum XRPL bridge by abusing a missing verification check, with no evidence of XRP Ledger compromise.
2. XRP briefly slipped to about $0.99 on the news before rebounding near $1.02, with sell pressure amplified by thin liquidity and broader structural headwinds.
3. The key watchpoints are Coreums fixes and reopen decision, XRP liquidity around the $1 level, and whether ongoing ETF and macro flows remain weak or stabilize.

Confidence: high because multiple independent reports align on the exploit and price move.

Deep Dive

1. How The Bridge Was Hacked

Reports say an attacker drained about 199,916 XRP from the Coreum XRPL bridge in roughly 97 minutes, nearly emptying its balance of about 200,410 XRP before the incident. The exploit targeted the bridges relayer logic, which credited deposits based on transaction memos without confirming that payments were actually sent to the bridge address, allowing the attacker to create fake deposits and then withdraw real XRP via normal bridge withdrawals. Every outgoing payment was signed by the bridges own multi-signature relayers, and there is no evidence that XRP Ledger consensus, native XRP, or private keys were compromised, making this a third party infrastructure failure rather than a chain-level bug, as detailed in a Coreum-focused bridge exploit report.

2. Price Impact And Broader Pressures

Following news of the bridge exploit, XRP dropped below $1 for the first time since late 2024, hitting an intraday low around $0.99 before recovering close to $1.02, a move of a few percent tied to a relatively small hack size compared to its roughly 63.99 B market cap and 1.45 B 24 hour volume. The drop landed on top of a longer downtrend, with coverage noting that XRP has significantly underperformed Bitcoin this year and that persistent supply from Ripples escrow and fading ETF inflows are damping any upside effect from positive ecosystem news. Some analysts also flag thinner order books on major venues around the $1 area, which can magnify price moves when sentiment sours.

3. What To Watch Next

There are three practical things to monitor. First, Coreums response: an incident report, code fixes that add destination checks, and any timeline to reopen the bridge will help gauge whether similar exploits stay possible on that route. Second, XRPs behavior around the $1 level: if liquidity remains thin and derivatives positioning is crowded, that support can break more easily on fresh negative news, whereas sustained trading above $1 with improving volume would suggest stabilizing sentiment. Third, flows and regulation: ETF inflows into XRP products and progress on regulatory clarity remain central themes in recent coverage, and sustained weak inflows would keep the supply imbalance in place.

Conclusion

A poorly designed verification step in the Coreum XRPL bridge let an attacker drain around 200,000 XRP, briefly pushing XRP below $1 despite no flaw in the XRP Ledger itself. The modest move under $1 sits within a larger downtrend driven by structural supply and weak inflows, so the bridge exploit is more of a sentiment shock than a fundamental break. Going forward, the quality of Coreums fixes, the depth of order books around $1, and the direction of ETF and macro flows will matter more for XRPs path than this single, relatively small bridge loss.