Ripple and the XRP Ledger team are facing scrutiny after awarding the maximum $250,000 bug bounty for a critical payment-engine flaw that could have allowed an attacker to create roughly 18 trillion XRP in a single transaction. The issue, undetected since 2015, was identified by an AI agent developed by security firm Veria Labs and patched under emergency procedures before any evidence of exploitation appeared on the public network.

How the Vulnerability Worked

The flaw resided in the XRP Ledger’s payment engine and involved an integer overflow that became exploitable when combined with a second, lower-severity issue dating to 2017. An attacker could create hundreds of accounts offering tiny quantities of a token in exchange for large amounts of XRP. Bundling those offers into one carefully constructed payment caused the ledger’s arithmetic to wrap around, so the buyer was charged only a negligible total while each seller still received the full amount. The same overflow bypassed the network’s supply-cap safeguard, effectively allowing new XRP to be minted outside the fixed 100 billion supply.

Veria Labs co-founder Cayden Liao stated that a single such transaction could have generated approximately 18 trillion XRP—nearly 184 times the token’s original supply. The firm’s AI agent discovered the combined vulnerability on September 21, constructed a working proof of concept on a private test network, and submitted the report through the official XRP Ledger bug-bounty program the following day.

Developers confirmed that ledger data is fully public, so any newly created XRP would have appeared immediately in account balances. An on-chain audit found no indication that the bug had ever been used on the main network.

Emergency Patch Bypassed Normal Governance

Under ordinary procedures, changes to the XRP Ledger require a two-week voting period among validators. Because public disclosure of the vulnerability before a fix was live would have created an attack window, RippleX released version 3.4.1 of the ledger software on September 25—three days after the report was received. More than 80 percent of validators on the default Unique Node List upgraded the same day. The disclosure report described the direct shipment as the first of its kind in more than a decade.

The XRP Ledger Foundation stated that the vulnerability never produced additional XRP because it existed only as a theoretical path around the supply limit rather than an active breach. A related Batch feature that had not yet been activated on the main network was also corrected in the same release cycle.

Criticism of the Bounty Amount

Veria Labs received the program’s maximum payout of $250,000 on October 8. Liao described the payment as the largest known bounty awarded for a vulnerability discovered entirely by an AI agent. The amount, however, quickly drew public criticism.

Blockchain investigator ZachXBT argued that $250,000 was inadequate for a flaw capable of threatening the entire network’s supply, especially given the scale of Ripple’s treasury. In posts on X he wrote that the finding “should be a 7 fig pay day at minimum” and warned that low rewards could discourage future researchers from reporting similar issues responsibly, potentially pushing them toward exploitation instead.

Daniel, CTO of HashLabs, separately questioned the size of the award, stating that Ripple should have added at least another zero and offered a minimum of $2.5 million. He argued that the payment failed to match the potential consequences of the vulnerability.

RippleX engineers responded that modern AI tools now allow critical bugs to be detected and patched quickly enough that attackers cannot reverse-engineer them from public code. The team said it intends to expand AI-assisted security testing and strengthen the bug-bounty program going forward.

Broader Context for the XRP Ecosystem

The security episode unfolded against a backdrop of continued institutional activity involving the XRP Ledger. Standard Chartered, working with LMAX Group, launched a custody service for the RLUSD stablecoin on the ledger through its Dubai branch. The service uses a collateral-mirroring model that lets institutional clients post RLUSD as margin without moving the asset across borders. The bank’s relationship with Ripple dates to 2015, when it participated in an early funding round and conducted distributed-ledger experiments in trade finance.

At the same time, shares of Evernorth, a public XRP treasury vehicle holding approximately 473 million XRP, began trading on Nasdaq under the ticker XRPN following a SPAC merger. The listing and the custody launch occurred while XRP traded near $1.40, consolidating after earlier September highs.

Developers and the foundation have maintained that the rapid patch and the absence of any on-chain exploitation preserved the integrity of the fixed supply. The episode has nonetheless focused attention on how large blockchain organizations structure incentives for independent security research, particularly as AI-driven discovery becomes more common.