XRP Ledger Pays $250,000 Bounty for Infinite Supply Vulnerability

The XRP Ledger paid Veria Labs its maximum $250,000 bug bounty after the company reported a vulnerability that could have created 18.45 trillion XRP in a single transaction, prompting criticism from blockchain investigator ZachXBT.

The flaw could have produced about 184 times the ledger’s stated 100 billion-token supply, with the process repeatable. It was an integer overflow in the payment engine that had existed since 2015.

Veria Labs reported the vulnerability Sept. 22 after discovering it Sept. 21. The XRP Ledger released an emergency update Sept. 25, when more than 80% of validators on the default UNL were running the patched software or a newer version. The related amendment activated on the mainnet Oct. 9.

No evidence showed that the vulnerability had been exploited on the public network. The 18.45 trillion XRP figure came from a controlled exploit demonstration rather than tokens shown to have entered circulation.

ZachXBT criticized the payment in a post on Oct. 12.

“Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?” he wrote. “Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith.”

He later wrote that the disclosure warranted at least a seven-figure reward and argued that the payment showed why “people do not take XRPL or Ripple” seriously.

The $250,000 payment was made Oct. 8 and represented the maximum available under the bug-bounty program. Veria Labs thanked the XRP Ledger team for its rapid response and described the payment as the largest bounty it knew of for a vulnerability found entirely by an artificial-intelligence agent.

The XRP Ledger Foundation plans to strengthen the bounty program and add formal verification and AI adversarial testing. The development follows the ledger’s earlier explanation of the emergency patch, which said the normal upgrade process would have left the vulnerability exposed for weeks.