ZachXBT Calls XRPL's $250K Bounty Too Low After Infinite Supply Bug Found
A $250,000 payout for a bug that could have inflated XRP infinitely
Crypto investigator ZachXBT says the XRP Ledger Foundation (XRPL) could lose more than $100 million in a future hack after paying whitehat hackers just $250,000 for reporting an infinite‑supply bug. He called the reward “cheap” and warned that the small payout might encourage criminals to exploit similar flaws instead of reporting them.
Key numbers
- Whitehat bounty paid: $250,000
- Potential future loss from a similar exploit: upwards of $100 million (ZachXBT’s estimate)
- XRP circulating supply: 100 billion coins
- XRP market cap at time of report: $86.5 billion
- Year the bug first appeared: 2015
- Date the vulnerability was reported to XRPL: September 22
- Date a fix was submitted: September 25
- XRP’s total value locked (TVL): $41.8 million
What the XRPL disclosure report says
In a report published on October 9, XRPL detailed the flaw that allowed new XRP tokens to be created from nothing. The bug was found by whitehat hackers Cayden Liao and Veria AI and submitted through XRPL’s bug‑bounty program on September 22.
XRPL explained that an “integer overflow in the payment engine” could be manipulated with certain XRP orders to underpay sellers. The engine would pay each seller their full amount individually but charge the buyer only a reduced, “wrapped‑around” total. The missing difference became new XRP that should never have existed.
The foundation stated there is “no evidence that this issue was exploited on any public network.” It added that the bug has existed since 2015.
Other bounty comparisons
ZachXBT pointed out that in 2022 a hacker who discovered a similar infinite‑supply flaw in Ethereum was paid a $2 million bug bounty for disclosing it.
DeFi risk‑management firm Llamarisk has also criticized recent bug‑bounty programs at Tether and Circle, saying their maximum payouts did not exceed $10,000. Llamarisk argued that a minimum of $50,000 is needed to attract decent security researchers and that protocols with total value locked above $250 million should offer maximum payouts exceeding $1 million to be considered sufficiently capitalized.
Confirmed facts
- XRPL reported the vulnerability on October 9.
- The bug was discovered by Cayden Liao and Veria AI and reported on September 22.
- The flaw involved an integer overflow in the payment engine that could underpay sellers and create unauthorized XRP.
- A fix was submitted by September 25.
- XRPL found no evidence the bug was exploited on any public network.
- The bug has been present since 2015.
- XRP’s total supply is capped at 100 billion coins, and the protocol was designed to prevent new XRP from being created.
- The current market capitalization of XRP is $86.5 billion.
- XRP’s TVL is $41.8 million.
Unanswered questions
- Whether the $250,000 bounty will be seen as adequate by the security community.
- Whether the low payout will deter future responsible disclosure and push attackers to exploit similar vulnerabilities.
- How XRPL will adjust its bug‑bounty program in response to the criticism.
Why the payout size matters
ZachXBT warned that a small reward could lead cybercriminals to choose exploitation over good‑faith reporting, potentially costing XRPL “nine figures” in a future incident. He also suggested the payout makes XRPL and its associated company Ripple look less serious in the eyes of observers.
Bug bounties are payments given to security researchers who find and responsibly disclose vulnerabilities in a system. Well‑funded programs can encourage hackers to report flaws instead of selling or publishing them publicly.
What comes next
No further steps or timelines were announced in the available sources.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.