Veria Labs Finds 10-Year-Old XRP Bug That Could Mint 18 Trillion Tokens

AI-powered search finds XRP bug that could print trillions of tokens

Security firm Veria Labs has been paid a $250,000 bug bounty for discovering an overflow bug in the code that runs the XRP Ledger (XRP, a cryptocurrency, runs on its own blockchain called the XRP Ledger, or XRPL). The bug has existed in the code since 2015, and a single crafted transaction could have minted more than 18 trillion XRP out of thin air — roughly 184 times the total supply. The bug has been patched and there is no evidence it was ever exploited.

Cayden Liao, co-founder of Veria Labs, explained on X (formerly Twitter) that the firm's AI agent scanned through rippled, the open-source software that powers the XRPL, and found two individual bugs rated as low severity. Liao said the researchers figured out how to combine them into a far more dangerous exploit. "This puts the full $94 billion at risk, more than 60 times the largest crypto hack on record," Liao wrote, referring to XRP's entire market capitalization at the time. He also noted that no one had caught the vulnerability before likely because the two bugs are harmless on their own and only become dangerous when chained together.

The bugs were reported on September 22, and RippleX patched them three days later. XRPLF, the foundation behind XRP, confirmed there is no evidence the vulnerability was exploited. Veria Labs received a $250,000 bounty for the disclosure.

Samsung Wallet adds USDC transfers for 82 million US users

Samsung plans to introduce USDC (a stablecoin pegged to the US dollar) transfers in its Samsung Wallet payment app during the last week of October. The feature will be available to 82 million eligible US Galaxy phone users. Users will be able to send USDC to compatible crypto wallets internationally and move money to eligible bank accounts in more than 60 countries, where recipients can receive funds in their local currency.

Access requires identity verification. Bastion will provide the stablecoin account and payment infrastructure, with Coinbase serving as sub-custodian through Coinbase Prime Vault. Solana and Sui were named as technical partners.

Cuomo says crypto's Republican-only backing is turning off Democrats

Former New York Governor Andrew Cuomo argued that the crypto industry's heavy support of US Republicans has alienated Democrats whose votes are needed to pass federal crypto legislation. Kalshi prediction markets put the probability of Democrats winning both chambers of Congress at about 61%.

Cuomo said a Democratic-controlled Congress could either roll back the SEC and CFTC's current crypto initiatives or work with the Trump administration to pass the full CLARITY Act. "You need Democrats to pass the bill. You need Republicans. You have to be more balanced," he said. He acknowledged a perception that Democrats are anti-crypto but argued the technology aligns with the party's goals around financial access.

Market movers and other stories from the week

• Bitcoin fell 2.8% to $83,435, Ethereum dropped 6.5% to $2,562, and XRP declined 7% to $1.40. The total crypto market cap was reported at $2.82 trillion.
• Top altcoin gainer: StarkNet (STRK) rose 91% after announcing plans to become a post-quantum Layer 1 blockchain (a Layer 1 is the base blockchain on which all transactions are recorded).
• Bitmine chair Tom Lee said at Token2049 that Ethereum could reach $25,000 to $50,000 per token by the end of the current market cycle. He also said Bitmine is close to its 5% ownership cap on Ether, holding roughly 6 million ETH.
• Coldcard, a Bitcoin hardware wallet, reported an unauthorized phishing link appeared on its official X account despite using offline two-factor authentication. The post has been deleted. DefiLlama's hack tracker estimated losses tied to a July Coldcard exploit at $115 million.
• THORChain co-founder Chad Barraford accused Tether of temporarily freezing the network's USDT vault addresses without explanation, locking roughly 1.45 million USDT across four wallets before unfreezing them hours later.
• New York permanently barred former Celsius CEO Alex Mashinsky from the crypto, securities, and commodities industries under a settlement with Attorney General Letitia James. The agreement includes up to $35 million in conditional payments and settles a 2023 civil lawsuit. Mashinsky is serving a 12-year federal prison sentence.

Sources

• Cointelegraph