Verify a decision

{"actor":"system:backfill","investigation_id":"887d9d7c-b9ab-4633-aafa-001b2aaa6ab6","kind":"publish","page_slug":"ripple-bug-bounty-controversy-xrpl-250k-payout-criticized-october-2026","published_at":"2026-10-13T23:17:49.947Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ripple Bug Bounty Controversy — XRPL $250K Payout Criticized (October 2026)","sections":[{"content":"An AI security agent developed by Veria Labs identified two chained integer-overflow vulnerabilities in the XRP Ledger's payment engine that had reportedly been present since 2015. The first overflow resided in the BookStep aggregation code introduced in November 2015: when accumulating offer inputs using a signed 64-bit integer, the sum could wrap around to a small value if the combined XRP input from multiple offers exceeded the signed 64-bit ceiling. The second overflow affected the XRPNotCreated supply-preservation invariant introduced in February 2017, whose accumulator — also a signed 64-bit integer — could likewise overflow when tracking balance changes across multiple accounts, allowing massive XRP creation to appear as a normal fee burn. By chaining both overflows, an attacker controlling 256 funded accounts with corresponding offers could have issued approximately 18.45 trillion spendable XRP in a single transaction, bypassing the network's 100 billion supply cap. Veria Labs estimated roughly $94 billion in network value was theoretically at risk, a figure they characterized as exceeding the largest crypto hack in history by approximately 60x. The XRPL Foundation confirmed no evidence of exploitation was found on any public network.","heading":"Vulnerability Details","severity":"critical","sources":[{"credibility":2,"name":"Veria Labs: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"XRP Ledger Patches Critical Bug That Could Have Minted 18.45 Trillion XRP — Blockfence","type":"news_article","url":"https://blockfence.io/xrp-ledger-patches-critical-bug-that-could-have-minted-18-45-trillion-xrp/"},{"credibility":2,"name":"XRP Ledger Had a Hidden Bug for 10 Years That Could Have Printed 18 Trillion XRP — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/xrp-ledger-had-hidden-bug-103114109.html"}]},{"content":"Veria Labs' AI security agent analyzed the rippled source code autonomously on September 21, 2026, identifying both vulnerabilities independently and chaining them into a functional exploit demonstrated on a local test network. Veria co-founder Cayden Liao stated that founders manually verified the findings multiple times before submitting. The vulnerability was reported to the XRP Ledger bug bounty program on September 22, 2026, and confirmed the same day. A fix was merged into the codebase on September 23. On September 25, rippled v3.4.1 was released with the patch; approximately 80% of validators upgraded within hours. The remediation implemented two technical safeguards: (1) a new checkedAdd helper function preventing overflow in BookStep's summation by returning std::nullopt on overflow and triggering a safe FlowException; and (2) widening the XRPNotCreated invariant's accumulator from a 64-bit to a 128-bit signed integer, making overflow mathematically impossible under legitimate transaction constraints. Notably, XRPL bypassed its standard amendment process — which ordinarily requires validator consensus over weeks — for the first time in over a decade, issuing an emergency patch to prevent potential exploitation during the standard disclosure period. The official public vulnerability report was published by RippleX on October 9, 2026. The $250,000 maximum bounty was awarded to Veria Labs on October 8, 2026.","heading":"Discovery, Disclosure, and Remediation","severity":"medium","sources":[{"credibility":2,"name":"Veria Labs: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"Critical Decade-Old Vulnerability in XRP Ledger Resolved — Forklog","type":"news_article","url":"https://forklog.com/en/critical-decade-old-vulnerability-in-xrp-ledger-resolved/"},{"credibility":2,"name":"Ripple Responds to Critical XRP Bug That Threatened Fixed Supply — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/security/ripple-responds-to-critical-xrp-bug-that-threatened-fixed-supply/"}]},{"content":"On October 12, 2026, on-chain investigator ZachXBT publicly criticized Ripple's $250,000 bounty payout, stating it 'should be a 7 fig pay day at minimum' for the researchers. His core argument centered on incentive misalignment: when a vulnerability threatens tens of billions of dollars in assets and the organization holding the bounty program controls a multi-billion-dollar treasury, a reward capped well below the potential profit from exploiting the bug may discourage responsible disclosure in future cases. ZachXBT cited the XRPL organization's large treasury as making the bounty disproportionately small relative to organizational resources and potential damage. Other researchers and commentators echoed the concern, arguing the structure systematically underincentivizes white-hat security researchers and leaves Ripple's ecosystem exposed to undiscovered vulnerabilities. Ripple and the XRPL Foundation had not publicly responded to ZachXBT's specific criticism as of the article's publication date. Veria Labs co-founder Cayden Liao characterized the $250,000 as the program's maximum payout and the largest bounty ever awarded for a vulnerability discovered entirely by an AI agent, without directly addressing whether the ceiling itself was appropriate.","heading":"Bug Bounty Payout Criticism","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Slams $250K Bounty for XRP Ledger Bug That Could Have Minted 18 Trillion XRP — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/10/12/zachxbt-slams-250k-bounty-for-xrp-ledger-bug-that-could-have-minted-18-trillion-xrp/"},{"credibility":2,"name":"ZachXBT Renews 'Cheap Ripple' Criticism Over $250K Bounty — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-ripple-criticism-bounty-xrp-bug/"},{"credibility":2,"name":"ZachXBT Calls $250K XRP Ledger Bug Bounty Too Low — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33579863/"},{"credibility":2,"name":"ZachXBT Criticizes XRPL's Low Bug Bounty — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-criticizes-xrpl-s-low-bug-bounty-250-000-reward-seen-as-undermining-incentives-for-white-hats"},{"credibility":2,"name":"XRPL Pays $250K for Infinite XRP Exploit, Criticized as 'Cheap' — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/xrpl-pays-250k-for-infinite-xrp-exploit-criticized-as-cheap-by-crypto-investigator"}]},{"content":"Critics invoked several comparisons to contextualize the $250,000 payout relative to industry norms for comparable severity. ZachXBT cited the Zcash precedent: security researcher Taylor Hornby received a total of $1.5 million — a $750,000 bounty plus a $750,000 community bonus approved by Zcash token holders — for disclosing a counterfeiting vulnerability in Zcash's Orchard shielded pool that reportedly put approximately $2.3 billion in ZEC at risk. Zcash leadership characterized the original bounty amount as representing only approximately 0.033% of funds at risk against a 0.24% minimum standard the community considered appropriate. For context on program maximums elsewhere in the ecosystem, LayerZero Labs operates a bug bounty on Immunefi with a maximum payout of $15 million for critical vulnerabilities. Wormhole paid a single $10 million bounty in 2022 for disclosure of a critical bridge vulnerability. The largest active single bug bounty program as of mid-2026 was reportedly a $16 million program on Sherlock. Ripple had previously run a separate $200,000-maximum Attackathon competition on Immunefi in late 2025 specifically for its proposed XRPL lending protocol, indicating the $250,000 ceiling for core protocol bugs was not a temporary or isolated figure.","heading":"Industry Benchmark Comparison","severity":"high","sources":[{"credibility":2,"name":"Zcash to Retroactively Award $1.5M for Orchard Vulnerability Discovery — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/zcash-to-retroactively-award-1-5m-for-orchard-vulnerability-discovery"},{"credibility":2,"name":"ZachXBT Criticizes Ripple's $250,000 Bounty — Here Is What Ethereum, Solana and Others Pay — 24/7 Wall St. via Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/zachxbt-criticizes-ripple-250-000-142535363.html"},{"credibility":2,"name":"LayerZero Launches Record-Breaking $15M Crypto Bug Bounty Program — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/layerzero-launches-record-breaking-15m-crypto-bug-bounty-program/"},{"credibility":2,"name":"Wormhole Announces $10 Million Bug Bounty Payout — The Block","type":"news_article","url":"https://www.theblock.co/post/148085/wormhole-announces-10-million-bug-bounty-payout"},{"credibility":2,"name":"Ripple and Immunefi Launch Attackathon Aimed at Securing XRPL Lending Protocol — The Block","type":"news_article","url":"https://www.theblock.co/post/374333/ripple-immunefi-attackathon-xrpl-lending-protocol"}]},{"content":"A secondary disclosure concern identified by Protos relates to the Evernorth Holdings (XRPN) merger timeline. Evernorth — a Ripple-backed XRP treasury company with approximately 473 million XRP — was proceeding through a shareholder vote to list on Nasdaq via a merger with Armada Acquisition Corp. Shareholders faced a September 28 redemption deadline; the shareholder vote passed on September 30; the merger closed on October 9, 2026. The critical vulnerability was reported to Ripple on September 22 and patched on September 25, but the official public vulnerability disclosure was not published until October 9 — after the merger closed. According to reporting by Protos, shareholders made their redemption and voting decisions without knowledge of the critical flaw, whose potential to mint trillions of new XRP directly undermined a core element of XRPN's investment thesis: XRP's fixed 100 billion supply. It is not established whether Ripple or Evernorth had any legal obligation to disclose the unpatched vulnerability to shareholders during the active remediation window, and no regulatory action or legal proceeding related to this disclosure timeline had been reported as of October 13, 2026. This section reflects an alleged concern raised in media reporting and does not assert any finding of wrongdoing.","heading":"XRPN Shareholder Disclosure Concern","severity":"high","sources":[{"credibility":2,"name":"XRPN Took Shareholder Vote With No Knowledge of XRP Inflation Bug — Protos","type":"news_article","url":"https://protos.com/xrpn-took-shareholder-vote-with-no-knowledge-of-xrp-inflation-bug/"},{"credibility":2,"name":"XRP Shareholders Voted Ignorant of Inflation Bug Before Evernorth's Nasdaq Listing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/xrp-shareholders-voted-ignorant-of-inflation-bug-before-evernorth-s-nasdaq-listing"},{"credibility":2,"name":"Evernorth Is One Vote Away From Bringing XRP Treasury Stock XRPN to Nasdaq — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/evernorth-one-vote-away-bringing-132232379.html"}]},{"content":"RippleX engineers publicly defended the speed of their response, noting that the vulnerability was identified, patched, and deployed across validators within three days, and emphasizing that AI tools now make it possible to catch and patch critical bugs fast enough to prevent exploitation during a responsible disclosure window. RippleX stated plans to expand AI-assisted security testing, strengthen its bug bounty program going forward, and conduct expanded adversarial testing. The XRPL Foundation confirmed that the bug never resulted in any additional XRP being created, as it represented a potential path around the supply cap rather than an actual breach, and that all ledger data is publicly verifiable so any illicit XRP creation would be immediately visible in account balances. Neither Ripple nor the XRPL Foundation had publicly addressed ZachXBT's specific call for a seven-figure minimum payout ceiling as of October 13, 2026. No specific increase to the maximum bounty amount had been announced as of that date.","heading":"Ripple's Response and Forward Commitments","severity":"medium","sources":[{"credibility":2,"name":"Ripple Responds to Critical XRP Bug That Threatened Fixed Supply — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/security/ripple-responds-to-critical-xrp-bug-that-threatened-fixed-supply/"},{"credibility":2,"name":"XRP Foundation Releases Emergency Fix as Critics Blast Bug Bounty Payout — Coin-Turk","type":"news_article","url":"https://en.coin-turk.com/xrp-foundation-releases-emergency-fix-as-critics-blast-bug-bounty-payout/"},{"credibility":2,"name":"Ripple Warns About AI Threat Following Bug That Could Have Created Billions of XRP — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33573714/"}]},{"content":"The Veria Labs disclosure represents a notable instance of an AI agent independently discovering, chaining, and producing a working proof-of-concept for two previously unknown critical vulnerabilities in a production blockchain codebase. Veria Labs positions itself as building AI pentesting agents for automated vulnerability discovery and remediation, citing clients including Posthog, Phantom, and Tempo. Cayden Liao described the $250,000 payout as the largest ever for a vulnerability found entirely by an AI agent. RippleX acknowledged the broader implication that AI tooling has substantially lowered the cost floor for finding legacy bugs, making the threat surface from both white-hat and malicious actors materially larger — and arguing this trend justifies expanded AI-assisted defensive security investment. The episode is being discussed in security research circles as a signal that bug bounty programs designed for human-paced manual auditing may be structurally mis-sized for an era of automated vulnerability discovery.","heading":"AI-Assisted Vulnerability Discovery Context","severity":"medium","sources":[{"credibility":2,"name":"Veria Labs: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"An AI Found a Bug That Could Mint 18 Trillion XRP. The Reward Was $250,000. — TrustSwap Blog","type":"news_article","url":"https://trustswap.com/blog/an-ai-found-a-bug-that-could-mint-18-trillion-xrp-the-reward-was-250-000"},{"credibility":2,"name":"Ripple Warns About AI Threat Following Bug That Could Have Created Billions of XRP — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33573714/"},{"credibility":2,"name":"Veria Labs AI Security Agent Uncovers XRPL Vulnerability — Archynewsy","type":"news_article","url":"https://www.archynewsy.com/veria-labs-ai-security-agent-uncovers-xrpl-vulnerability/"}]}],"sources_used":[{"credibility":2,"name":"Veria Labs: The Biggest Hack in Crypto History That Never Happened","type":"official","url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"credibility":2,"name":"ZachXBT Slams $250K Bounty for XRP Ledger Bug That Could Have Minted 18 Trillion XRP — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/10/12/zachxbt-slams-250k-bounty-for-xrp-ledger-bug-that-could-have-minted-18-trillion-xrp/"},{"credibility":2,"name":"ZachXBT Renews 'Cheap Ripple' Criticism Over $250K Bounty — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-ripple-criticism-bounty-xrp-bug/"},{"credibility":2,"name":"ZachXBT Calls $250K XRP Ledger Bug Bounty Too Low — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33579863/"},{"credibility":2,"name":"ZachXBT Criticizes XRPL's Low Bug Bounty — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/zachxbt-criticizes-xrpl-s-low-bug-bounty-250-000-reward-seen-as-undermining-incentives-for-white-hats"},{"credibility":2,"name":"XRPL Pays $250K for Infinite XRP Exploit, Criticized as 'Cheap' — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/xrpl-pays-250k-for-infinite-xrp-exploit-criticized-as-cheap-by-crypto-investigator"},{"credibility":2,"name":"Critical Decade-Old Vulnerability in XRP Ledger Resolved — Forklog","type":"news_article","url":"https://forklog.com/en/critical-decade-old-vulnerability-in-xrp-ledger-resolved/"},{"credibility":2,"name":"XRP Ledger Had a Hidden Bug for 10 Years That Could Have Printed 18 Trillion XRP — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/xrp-ledger-had-hidden-bug-103114109.html"},{"credibility":2,"name":"XRPN Took Shareholder Vote With No Knowledge of XRP Inflation Bug — Protos","type":"news_article","url":"https://protos.com/xrpn-took-shareholder-vote-with-no-knowledge-of-xrp-inflation-bug/"},{"credibility":2,"name":"XRP Shareholders Voted Ignorant of Inflation Bug Before Evernorth's Nasdaq Listing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/xrp-shareholders-voted-ignorant-of-inflation-bug-before-evernorth-s-nasdaq-listing"},{"credibility":2,"name":"Zcash to Retroactively Award $1.5M for Orchard Vulnerability Discovery — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/zcash-to-retroactively-award-1-5m-for-orchard-vulnerability-discovery"},{"credibility":2,"name":"ZachXBT Criticizes Ripple's $250,000 Bounty — Here Is What Ethereum, Solana and Others Pay — Yahoo Finance (24/7 Wall St.)","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/zachxbt-criticizes-ripple-250-000-142535363.html"},{"credibility":1,"name":"LayerZero Launches Record-Breaking $15M Crypto Bug Bounty Program — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/layerzero-launches-record-breaking-15m-crypto-bug-bounty-program/"},{"credibility":1,"name":"Wormhole Announces $10 Million Bug Bounty Payout — The Block","type":"news_article","url":"https://www.theblock.co/post/148085/wormhole-announces-10-million-bug-bounty-payout"},{"credibility":1,"name":"Ripple and Immunefi Launch Attackathon for XRPL Lending Protocol — The Block","type":"news_article","url":"https://www.theblock.co/post/374333/ripple-immunefi-attackathon-xrpl-lending-protocol"},{"credibility":2,"name":"Ripple Responds to Critical XRP Bug That Threatened Fixed Supply — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/security/ripple-responds-to-critical-xrp-bug-that-threatened-fixed-supply/"},{"credibility":2,"name":"Ripple Fixes XRPL Flaw That Could Mint 184 Times XRP Supply, But $250,000 Bug Bounty Stirs Criticism — Digital Today","type":"news_article","url":"https://www.digitaltoday.co.kr/en/view/113580/ripple-xrpl-flaw-xrp-issuance-bug-bounty-250000-stirs-controversy"},{"credibility":2,"name":"ZachXBT Slams $250K Bounty for Critical XRP Ledger Bug — CoinInsider","type":"news_article","url":"https://www.coininsider.org/news/xrp-ledger-critical-bug-250k-bounty/"},{"credibility":2,"name":"An AI Found a Bug That Could Mint 18 Trillion XRP. The Reward Was $250,000. — TrustSwap Blog","type":"news_article","url":"https://trustswap.com/blog/an-ai-found-a-bug-that-could-mint-18-trillion-xrp-the-reward-was-250-000"},{"credibility":2,"name":"Ripple Warns About AI Threat Following Bug That Could Have Created Billions of XRP — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33573714/"}],"summary":"In September–October 2026, Veria Labs disclosed a decade-old critical integer-overflow vulnerability in the XRP Ledger that could theoretically have minted approximately 18.45 trillion XRP — roughly 184 times the network's fixed 100 billion supply cap — in a single transaction. Ripple paid Veria Labs the maximum allowable bounty under its program, $250,000, and patched the flaw within three days of disclosure. On-chain investigator ZachXBT and multiple researchers publicly criticized the payout as severely inadequate relative to the severity of the vulnerability, the scale of assets at risk, and industry benchmarks from comparable protocols, arguing the structure systematically underincentivizes white-hat disclosure.","timeline":[{"date":"2015-11-01","event":"First integer-overflow vulnerability introduced into XRP Ledger BookStep aggregation code (approximate date based on codebase history).","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2017-02-01","event":"Second integer-overflow vulnerability introduced into XRPNotCreated supply-preservation invariant (approximate date based on codebase history).","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-09-21","event":"Veria Labs' AI security agent autonomously identifies both vulnerabilities in rippled source code and chains them into a working exploit on a local test network.","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-09-22","event":"Veria Labs submits working proof-of-concept to the XRP Ledger bug bounty program. Submission confirmed same day by RippleX.","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-09-23","event":"Fix merged into the rippled codebase.","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-09-25","event":"rippled v3.4.1 released with the patch, bypassing the standard amendment process. Approximately 80% of validators upgraded within hours.","source":"Veria Labs blog / Forklog","source_url":"https://forklog.com/en/critical-decade-old-vulnerability-in-xrp-ledger-resolved/"},{"date":"2026-09-28","event":"XRPN shareholder redemption window closes. Shareholders had not been informed of the critical vulnerability or its patch.","source":"Protos","source_url":"https://protos.com/xrpn-took-shareholder-vote-with-no-knowledge-of-xrp-inflation-bug/"},{"date":"2026-09-30","event":"XRPN shareholder vote passes, approving the Evernorth Holdings merger and its path toward a Nasdaq listing.","source":"Protos / CoinGape","source_url":"https://protos.com/xrpn-took-shareholder-vote-with-no-knowledge-of-xrp-inflation-bug/"},{"date":"2026-10-08","event":"Ripple awards Veria Labs the maximum $250,000 bounty for the vulnerability.","source":"Veria Labs blog","source_url":"https://verialabs.com/blog/biggest-hack-in-crypto-history/"},{"date":"2026-10-09","event":"RippleX publishes official public vulnerability disclosure report. Evernorth merger closes same day.","source":"Protos / Bitcoin.com News","source_url":"https://protos.com/xrpn-took-shareholder-vote-with-no-knowledge-of-xrp-inflation-bug/"},{"date":"2026-10-12","event":"ZachXBT publicly criticizes the $250,000 bounty payout, stating it 'should be a 7 fig pay day at minimum,' and warns the structure may discourage future responsible disclosure.","source":"CryptoTimes / Cryptopolitan","source_url":"https://www.cryptotimes.io/2026/10/12/zachxbt-slams-250k-bounty-for-xrp-ledger-bug-that-could-have-minted-18-trillion-xrp/"},{"date":"2026-10-13","event":"No public response from Ripple or the XRPL Foundation to ZachXBT's bounty criticism. No increase to the maximum bounty ceiling announced.","source":"CryptoTimes / Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-ripple-criticism-bounty-xrp-bug/"}]},"v":1}