Ripple Bug Bounty Controversy — XRPL $250K Payout for 18-Trillion-XRP Flaw
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·wedvum…M1TfSummary
In September 2026, an AI-assisted security team discovered a critical decade-old integer overflow in the XRP Ledger's payment engine that could theoretically have minted 18.45 trillion XRP in a single transaction — 184 times the protocol's fixed 100 billion supply cap. Ripple patched the flaw in xrpld 3.4.1 on September 25, with no evidence of prior exploitation, and paid the discoverers $250,000 — the stated program maximum. The payout size drew public criticism from blockchain investigator ZachXBT and others, who argued it was systematically inadequate relative to the severity of the flaw and to the bug bounty programs maintained by comparable networks.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(10 events)
1 January 2015
Integer overflow code containing the BookStep vulnerability written and incorporated into XRP Ledger's payment engine (approximate year per Veria Labs; exact date not publicly disclosed).
Veria Labs blog1 January 2017
XRPNotCreated invariant code written, which would later itself overflow and mask the exploit (approximate year per Veria Labs).
Veria Labs blog21 September 2026
Veria Labs' AI agent identifies the integer overflow vulnerability in the XRP Ledger payment engine.
Veria Labs blog22 September 2026
Cayden Liao builds a working proof-of-concept exploit and submits the vulnerability report to Ripple via the XRPL bug bounty program. RippleX raises severity classification to critical.
FinanceFeeds / Forklog25 September 2026
xrpld 3.4.1 released. Over 80 percent of default validators upgrade. Ripple bypasses the standard amendment voting process for the first time in the ledger's history to prevent premature public exposure of the flaw.
Crypto.news / TechTimes8 October 2026
Ripple pays Veria Labs and Cayden Liao $250,000 — the stated maximum under the XRPL Bug Bounty program.
Veria Labs blog / CryptoTimes9 October 2026
Full public disclosure of the vulnerability published. A separate Batch transaction validation error patched in the same release also disclosed.
FinanceFeeds / Crypto.news12 October 2026
ZachXBT publicly criticizes the $250,000 bounty on X, stating the finding should be a seven-figure payday at minimum and warning that low payouts disincentivize responsible disclosure.
CryptoTimes / CryptoAdventure13 October 2026
Multiple outlets including 247 Wall St. and Benzinga publish comparative analyses of bug bounty maximums across Ethereum, Solana, LayerZero, and Wormhole. Neither Ripple nor the XRP Ledger Foundation had responded publicly as of those publications.
247 Wall St. / BenzingaDecision Log
- slot 456834157 · hash HgeAXTtnF8UiryhfJzjCW1SDfY4Ug5AQvUGkUEJQ4yxD
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 5 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/14/2026, 12:12:16 PM
last updated: 10/14/2026, 12:12:17 PM
avoid.net — verified advice for a post-truth world