XRP Ledger patched a bug that could have minted 18 trillion XRP

Security firm Veria Labs reported a payment-engine vulnerability in the XRP Ledger to XRPL's bug bounty program on September 22, and RippleX released xrpld 3.4.1 on September 25 to patch a flaw that could have minted roughly 18 trillion XRP in a single transaction — about 180 times the network's 100 billion XRP supply cap. Veria Labs founder Cayden Liao said an AI agent run by his firm found the bug on September 21 and built a working proof-of-concept exploit the next day, and Ripple paid the $250,000 maximum bounty, which Liao called the largest reward he is aware of for a vulnerability found entirely by an AI agent. The emergency release bypassed XRPL's amendment vote, and more than 80% of validators on the network's default Unique Node List were running xrpld 3.4.1 on release day, with RippleX finding no evidence the bug was exploited on any public network.

An AI agent found a decade-old flaw in the XRP Ledger's payment engine that could have let one transaction create 180 times the coin's entire supply. Ripple paid out $250,000, and the network patched it in three days. For a few days in September, the integrity of one of crypto's largest networks rested on a bug that had sat untouched since 2015. Security firm Veria Labs reported the flaw to XRPL's bug bounty program on September 22, and RippleX moved fast: developers released xrpld 3.4.1 just three days later, on September 25, patching a payment engine vulnerability that could have minted roughly 18 trillion XRP in a single transaction. That is about 180 times the entire 100 billion XRP supply cap. The mechanics are almost mundane, which is what makes them unsettling. When a payment on the XRP Ledger pulls value from multiple offers sitting in the network's order book, the payment engine adds those amounts together using a 64-bit integer. There was no check for what happens when that sum exceeds the integer's maximum value. Past that ceiling, the number wraps around to something small, the way an odometer rolls back to zero. The ledger kept paying every offer owner their full, correct amount. The buyer, meanwhile, got charged only the wrapped-around total, a number that could be a tiny fraction of what was actually owed. Cayden Liao, founder of Veria Labs, said the discovery didn't start with a human hunch. An AI agent run by his firm found the vulnerability on September 21, then spent the next day working out how to chain it with a second bug and building a functional proof-of-concept exploit on a local test network. Liao called the $250,000 payout, the maximum under Ripple's bug bounty program, the largest reward he's aware of for a vulnerability found entirely by an AI agent. That detail matters as much as the bug itself: this wasn't a researcher staring at diffs for weeks. It was a model finding a decade-old arithmetic blind spot and proving it was exploitable, on its own. XRPL normally changes its rules through an amendment process: a proposal goes out, validators vote, and a supermajority has to agree before new logic takes effect network-wide. That process is slow by design. Nobody wants a payment network's core logic changing on a whim. AI agents have moved over 200 million payments on x402, but half may be fake https://startupfortune.com/ai-agents-have-moved-over-200-million-payments-on-x402-but-half-may-be-fake/ Visa's Todd Sheffield pegs real x402 volume at just $19 million after stripping out wash trading, while Solana has quietly overtaken Coinbase's Base network, commanding roughly 70% of monthly transactions by August. - how to identify fake AI agent blockchain transactions https://startupfortune.com/ai-agents-have-moved-over-200-million-payments-on-x402-but-half-may-be-fake/ - x402 protocol agent payment volume verification methods https://startupfortune.com/ai-agents-have-moved-over-200-million-payments-on-x402-but-half-may-be-fake/ This time there was no waiting. The fix shipped as an emergency release that took effect on each node immediately after upgrading, bypassing the amendment vote entirely. According to a report from The Block, more than 80% of validators on the network's default Unique Node List were running xrpld 3.4.1 on the day it was released. RippleX found no evidence that the bug was exploited on any public network. No unauthorized XRP was created, while the original 100 billion supply has continued to shrink slightly as transaction fees are burned. Don't mistake the clean outcome for proof the system worked as intended. It worked because someone reported the bug before an attacker found it, and because the fix outran any attempt to exploit it. Those are two different kinds of luck, and a payment network with a market capitalization in the tens of billions of dollars shouldn't need either one. An unchecked integer overflow sitting in core settlement logic for eleven years is the kind of thing audits are supposed to catch long before a bounty program does. XRP has built its entire pitch around a hard, fixed supply of 100 billion tokens, a promise that distinguishes it from inflationary currencies and most altcoins with ongoing issuance. A bug that could silently mint 180 times that amount in one payment doesn't just threaten a price chart. It threatens the one property the asset is sold on. That the flaw lived in the order-book payment path, one of the ledger's most frequently used features, rather than some obscure edge case, is its own quiet indictment of how long basic overflow protections can go unchecked in widely used financial infrastructure. There's a broader thread here too, and it's not really about XRP. An AI agent finding and weaponizing an eleven-year-old vulnerability in under 48 hours is a preview of what security research looks like when both sides, defenders and attackers, get faster tools. The protocol's own defenses took three days to catch up once the clock started. That's the margin crypto security now runs on. Next time, something might not report to a bounty program first. Also read: Ramp Applies for a National Trust Bank Charter to Custody Crypto https://startupfortune.com/ramp-applies-for-a-national-trust-bank-charter-to-custody-crypto/ • Bitwise shuts down its Dogecoin ETF less than a year after launch https://startupfortune.com/bitwise-shuts-down-its-dogecoin-etf-less-than-a-year-after-launch/ • Zcash jumps 9% as investors treat its privacy ledger as a Bitcoin hedge https://startupfortune.com/zcash-jumps-9-as-investors-treat-its-privacy-ledger-as-a-bitcoin-hedge/ This article is posted in Crypto News https://startupfortune.com/category/crypto/ , check it out for more related stories. Join the discussion Open in the community → https://startupfortune.com/community/ Almost there. Sign in and your reply posts straight away.