AI uncovers XRP Ledger flaw that could have minted 18 trillion tokens
AI security agent finds critical XRP Ledger bug
An artificial intelligence tool from security firm Veria Labs discovered a ten-year-old vulnerability in the XRP Ledger that could have allowed the creation of 18 trillion XRP tokens. The flaw was reported on September 22 and patched three days later. The network confirmed the fix publicly on October 9.
The vulnerability consisted of two connected weaknesses. One involved the payment engine, where a specially crafted transaction could cause the system to miscalculate how much a buyer owed. The other affected the ledger's supply-protection mechanism, which relies on the same arithmetic. Together, they could have let someone generate new XRP out of nothing.
Official reports confirm no unauthorized XRP was created and no funds were lost. Investigators found no evidence that the flaw was exploited on public networks before it was fixed.
What the flaw could have done
- A single transaction could have generated about 18 trillion XRP, roughly 180 times the token's original 100 billion supply.
- The attack would have required preparing hundreds of accounts and trading offers before submitting the payment transaction.
- Getting started needed only a few hundred XRP in mostly refundable reserves and ordinary transaction fees.
- Officials said the flaw potentially threatened XRP's $94 billion market by undermining its fixed supply.
How the discovery was made
Veria's AI-powered security system analyzed rippled, the software that runs the XRP Ledger, and identified the two weaknesses. The underlying payment-engine code dates to 2015, while the supply safeguard was added in 2017. Both survived more than a dozen audits and security contests since 2024, including one competition with a $550,000 prize pool. The network's bug bounty programs have also distributed more than $1 million.
Veria's founder, Cayden Liao, said the combined vulnerability remained hidden until the AI system found it, assembled a working exploit, and demonstrated the problem on a local test network. RippleX engineers later reproduced the exploit independently and confirmed the fake XRP could be spent in later transactions.
Emergency patch bypasses normal process
Under normal rules, changes to how the ledger processes transactions need approval from more than 80 percent of trusted validators over two consecutive weeks. Developers decided that following this process would leave the network exposed while voters debated the fix. Publishing the code publicly could also have alerted attackers before the protection was active.
Instead, RippleX, the XRP Ledger Foundation, and validators coordinated an emergency upgrade that took effect immediately on servers running version 3.4.1. The initial fix was distributed as compiled binaries while the source code was held back temporarily, limiting the chance that attackers could study the vulnerability during deployment.
The disclosure described this as the first deliberate bypass of the amendment process for a transaction-processing change in more than a decade. Running different software versions at the same time carries its own risk, because servers could disagree on whether a suspicious transaction is valid. More than 80 percent of validators on the default trusted list had upgraded by September 25, reducing that risk.
Rewards and next steps
Veria received a $250,000 bounty, the program's maximum payout. Liao called it the largest known reward for a vulnerability discovered entirely by an AI agent.
An XRP Ledger Foundation contributor named Vet said the coordinated response preserved network integrity and that version 3.4.1 became the new minimum software requirement after separate batch-related amendments activated on October 9.
Why this matters
The incident shows that even heavily audited blockchains can harbor serious bugs, and that artificial intelligence tools may detect problems human reviewers miss. It also highlights the tension between careful, consensus-based upgrades and the need for speed when a critical flaw is found. The XRP Ledger's decision to override its own amendment process signals how seriously developers view the risk.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.