On-chain investigator ZachXBT has criticized the $250,000 reward paid for a critical XRP Ledger (XRPL) vulnerability that could have allowed an attacker to create about 18.45 trillion XRP in a single transaction. That is roughly 184 times the token’s fixed 100 billion supply. An artificial intelligence (AI) agent built by security firm Veria Labs found the flaw, and the XRPL’s official disclosure report says there is no evidence it was ever exploited on any public network.
ZachXBT is a pseudonymous blockchain investigator known for tracing crypto hacks and scams. In a post on X on October 12, 2026, he argued that a $250,000 payout was too low for a bug of this scale when the organization’s “treasury has billions.” He warned that low rewards could push a future attacker to exploit a similar flaw instead of reporting it.
In a follow-up post, he said the finding “should be a 7 fig pay day at minimum” for researcher Cayden Liao and Veria Labs. He also compared the payout with a seven-figure reward he said was paid in the Zcash ecosystem for a recent counterfeiting bug.
What the XRP Ledger Bug Did
According to the XRPL Vulnerability Disclosure Report for xrpld 3.4.1, published on October 9, 2026, the flaw was an integer overflow in the ledger’s payment engine. An integer overflow happens when a calculation produces a number larger than a computer variable can hold, causing the value to “wrap around” to a very small number.
The XRPL has a built-in decentralized exchange (DEX) where users place offers to trade tokens. When a single payment consumed many offers from the order book, the engine added up the amounts using 64-bit integer math with no overflow check. If the total exceeded the maximum value, it wrapped to a small number. The engine then paid each offer owner the full amount of their offer but charged the buyer only the wrapped total. The difference was newly created XRP that could be spent like any other XRP.
The ledger also runs an automatic safety check, called an invariant, that is meant to confirm no transaction creates XRP. The disclosure report says that check summed balance changes the same way and wrapped around identically, so it failed to catch the imbalance.
In its technical write-up published October 10, Veria Labs said its AI agent found and chained two separate overflows: one in order-book processing code written in November 2015 and one in the “XRPNotCreated” invariant added in February 2017. The firm’s proof of concept (PoC), a working demonstration run on a local test network, used 256 offers to credit 18.45 trillion XRP across 256 accounts in one transaction. Veria said the attack could be repeated, and it put the exposure at the full XRP market capitalization of about $94 billion, based on an XRP price of $1.59 at the time.
The disclosure report notes that the attack required hundreds of offers priced in a way no real trader would use, followed by a payment built specifically to consume them all at once. However, the same report says the exploit was cheap, costing only a few hundred XRP in refundable account and offer reserves plus ordinary transaction fees.
Emergency Patch Bypassed the XRPL Amendment Vote
The incident response timeline shows the bug was reported through the XRPL Bug Bounty program on September 22, 2026, and initially rated “Major.” RippleX engineers, the development arm of Ripple that contributes to XRPL software, reproduced it the same day, confirmed the minted XRP could be spent in a follow-up payment, and raised the severity to critical. A fix was merged on September 23.
The patch shipped in xrpld 3.4.1 on September 25, 2026. The xrpld software, formerly known as rippled, is the server program that runs the XRP Ledger. At release, the update was publicly described as a Batch-related fix and stability update for node operators, while the mint fix was kept private. More than 80% of validators on the default Unique Node List (UNL), the list of trusted validators that XRPL servers rely on to agree on the state of the ledger, were running the new version that same day.
Normally, changes to transaction processing go through the XRPL amendment process, which requires support from more than 80% of trusted validators for two weeks before activation. The disclosure report states that this fix instead took effect as soon as each server upgraded, the first time a transaction processing change has deliberately skipped that process since the amendment system was introduced more than ten years ago.
The report explains that because xrpld is open source, a standard amendment would have exposed the bug publicly for weeks while it remained exploitable on the main network. The source code for xrpld 3.4.1 was published later.
The same release also fixed a separate, lower-severity flaw in the Batch feature, which lets one account submit up to eight transactions as a single unit. That issue was reported on September 18, and its fix, the fixBatchV1_2 amendment, activated on the XRPL mainnet on October 9, 2026. The report says the Batch feature had not been active on the main network, so no accounts or funds were affected.
Veria Labs Calls It the Largest AI-Found Bug Bounty
According to Veria Labs’ timeline, its AI agent identified the infinite mint on September 21, built the PoC on September 22, and the firm was awarded the program’s maximum critical bounty of $250,000 on October 8. Veria said that, to its knowledge, this is the largest bounty ever paid for a vulnerability discovered entirely by an AI agent.
The XRPL disclosure report credits “Cayden Liao and Veria AI” in its acknowledgements for the original report and proof of concept.
The Whitehat Incentive Debate
ZachXBT’s criticism centers on incentives for whitehats, the ethical hackers who report flaws instead of exploiting them. His argument is that when a bug threatens an asset worth tens of billions of dollars, a reward far below the potential profit from an attack may make responsible disclosure less attractive.
Supporters of the current structure point to several factors. The $250,000 award was the top tier of the XRPL program, the flaw was disclosed responsibly, the fix was deployed before public disclosure, and no losses occurred. Veria itself noted that the XRPL has paid more than $1 million in bug bounties and undergone more than a dozen audits and audit contests since 2024.
As of publication, neither the XRP Ledger Foundation nor Ripple had publicly responded to ZachXBT’s criticism of the bounty amount.
What It Means for the XRP Supply and Node Operators
The disclosure report states that the fix now makes oversized order-book payments fail cleanly instead of minting XRP, and that the “no XRP created” check uses a wider counter that cannot wrap around. With no evidence of exploitation, the XRP supply remains capped at 100 billion tokens, which slowly decreases as small amounts are destroyed to pay transaction fees.
Server operators must run xrpld 3.4.1 or later to stay in sync with the network. Following the October 9 amendment activations, older versions are now “amendment blocked,” meaning they can no longer process the latest ledgers. The XRPL team also said it will now re-test every security finding marked as fixed against each release candidate before closing it.
Also Read: OKX’s Star Xu and Binance’s CZ, Yi He Clash Over Oct 10 Crash & $800M Bailout
