An AI Found a Bug That Could Have Minted 18 Trillion XRP. The Payout Was $250,000

Veria Labs' agent dug up a decade-old overflow in the XRP Ledger. The fix took three days. The size of the reward is what people are fighting about.

One transaction. About 18.45 trillion XRP, 184 times the token's entire 100 billion supply, created out of nothing and spendable the moment the ledger closed. That is what an AI agent from Veria Labs found in the XRP Ledger's payment engine, in code that had been live since 2015.

Nobody pulled it off. The XRPL's own disclosure report says there is "no evidence that this issue was exploited on any public network." RippleX patched the hole within three days of the report, and Veria was paid $250,000, the most the bug bounty program offers. On-chain investigator ZachXBT called the payout cheap, and the argument has not stopped since.

Two overflows, one very bad transaction

When a payment burns through a pile of order book offers at the same price, the engine adds up what the buyer owes. That sum used a signed 64-bit integer with no overflow check. Feed it enough huge offers and the total wraps around to something tiny. Every offer owner still gets paid in full. The buyer is charged the wrapped number. The gap is brand new XRP.

The ledger has a guard for exactly this, an invariant that rejects any transaction that creates XRP. It added up balance changes the same way, in the same kind of counter, so it wrapped the same way and saw nothing but an ordinary fee burn. Veria's write-up dates the offer-aggregation code to November 2015 and the invariant to February 2017.

The recipe was almost insultingly small: 256 offers, each asking for roughly 72 billion XRP, then one payment to eat them all. The XRPL does enforce its 100 billion cap per account, so the minted coins had to be spread across 256 wallets. According to the XRPL team, the attacker's real cost was a few hundred XRP in refundable reserves plus fees. It also could not happen by accident, since no ordinary trade comes anywhere near the overflow point.

Cayden Liao, Veria's security co-founder, wrote on X that each flaw alone would have rated low severity, and he suspects that is why a decade of audits missed the pair. Veria says it later pointed general-purpose coding agents at the same code and they still could not find it.

How big is 18 trillion?

Depends on who is counting. Veria values the haul at about $29 trillion. Other write-ups use roughly $25 trillion. Both are paper math, because nobody sells 18 trillion tokens into a market that would have gone to zero first. Veria's own framing is the sober one: the full $94 billion XRP market cap was at risk, more than 60 times Bybit's $1.5 billion, the largest hack on record.

Three days, no vote

Veria's agent flagged the bug on Monday, September 21. It was reported and confirmed on the 22nd, the fix was merged on the 23rd, and xrpld 3.4.1 shipped on September 25 with more than 80% of default UNL validators already running it.

Normally the XRPL changes transaction rules through an amendment. Validators vote, then more than 80% support has to hold for two weeks. This fix skipped all of that, the first time in over a decade, per the report. The reasoning: xrpld is open source, so an amendment would have advertised the bug for weeks while it stayed exploitable. The report admits the cost. During the upgrade window, servers on different versions could disagree about an exploit transaction, and in the worst case the network could halt. The team judged a halt better than a live, public mint.

Not everyone liked the trade. Cyber Capital's Justin Bons wrote that XRP had been running closed-source code for two weeks, since the 3.4.1 source landed well after the binaries. RippleX engineer Mayukha Vadari replied that "AI has changed things": slip a critical patch into a routine public release and it gets reverse-engineered almost immediately.

The same release fixed a separate bug in Batch, a feature that had not gone live yet. That fix and Batch itself activated on Friday, October 9, and servers on older versions can no longer stay in sync.

The $250,000 fight

The day after the disclosure report, the XRP Ledger Foundation posted a clarification thread. No XRP was created, it said, and the supply stays fixed. It also promised formal verification, AI adversarial testing and a stronger bounty program, with no dollar figure attached.

Then ZachXBT weighed in. Why does a treasury holding billions pay a white hat $250,000 for an infinite-supply bug? His answer: next time, an attacker may go for "9 figures instead of reporting it in good faith." BlockTempo reports he followed up minutes later, saying the find deserved at least seven figures and pointing to Zcash. Zcash token holders have approved $1.5 million for Taylor Hornby, who found the Orchard counterfeiting bug in May with help from Claude Opus 4.8: a $750,000 bounty plus a $750,000 community grant, still pending compliance checks, according to crypto.news.

XRP defenders see it differently. $250,000 is the program's published ceiling, and Veria applied, took the maximum and thanked the XRPL team in its own post. Veria even calls it the largest payout it knows of for a bug found entirely by an AI agent. BlockTempo reports that a self-described Foundation contributor, Vet, replied that they agree on the incentive structure. RippleX head of engineering J. Ayo Akinyele said the team will expand AI-assisted bug hunting and formal verification.

The part nobody can patch

Veria did nothing wrong, and neither did the program, which paid what it advertised. The ceiling is the problem. $250,000 is about 0.0003% of the market value Veria says was exposed, and Zcash's base bounty alone was three times larger.

AI is making old bugs cheaper to find for everyone. Veria points to the summer Coldcard drain, 1,367 BTC taken through a five-year-old firmware bug that Coinkite suspects AI helped find. This time the finder filed a report. The next one might price the decision differently, which is ZachXBT's whole point, and the arithmetic is hard to argue with.

No top-up for Veria and no new bounty ceiling had been announced at the time of writing.