ZachXBT Criticizes XRPL for Only Paying $250,000 Bug Bounty
On-chain detective ZachXBT responded to misunderstandings regarding security fixes from the XRP Ledger Foundation, stating that despite the treasury holding billions of dollars, it only paid $250,000 to a white hat hacker who discovered a serious vulnerability that could lead to unlimited issuance of XRP.
He claimed this is essentially enabling attackers to choose not to report vulnerabilities in good faith but to exploit them directly to steal nine-figure sums (hundreds of millions), which is why people cannot take the XRP Ledger or Ripple seriously as legitimate institutions.
The vulnerability is an integer overflow issue in the payment engine that has existed since 2015, which can be exploited by constructing hundreds of anomalous pricing quotes to allow buyers to pay a very low amount while sellers receive the full amount, thus generating approximately 18 trillion XRP (about 184 times the total supply of 100 billion).
The vulnerability was discovered and exploited by Cayden Liao and an AI agent from Veria Labs, reported through the bounty program on September 22, with RippleX releasing xrpld 3.4.1 fix within three days. By September 25, over 80% of default UNL validators had upgraded, with no evidence of exploitation on the public network.
Veria Labs confirmed it received the maximum bounty of $250,000 from the program, stating this is the highest payment for a vulnerability discovered entirely by an AI agent. The XRPL Foundation indicated that approximately 99.986 billion XRP are currently in circulation, with no new issuance.
The event is driven by the potential unlimited issuance risk discovered by AI and the controversy over bounty pricing, with funding directed towards limited white hat rewards rather than a higher proportion of risk compensation. The beneficiaries are the security researchers who reported promptly, while the burden falls on the trustworthiness of XRPL and Ripple institutions that rely on a fixed supply narrative.
The foundation plans to strengthen AI adversarial testing, formal verification, and bounty programs to address similar risks in the future.
Source: Public Information
ABAB AI Insight
Since its launch in 2012 with a fixed supply of 100 billion XRP, the XRP Ledger's payment engine code introduced relevant logic in 2015, historically relying on validator consensus and limited bounty programs to maintain security. After introducing AI red team testing in 2026, over a dozen vulnerabilities were discovered, continuing this path, but the bounty cap remains at around $250,000.
In terms of capital, Ripple holds billions in assets through the XRPL Foundation treasury, prioritizing resources for network operations and compliance rather than proportionally converting potential attack profits (which can reach hundreds of billions in market value) into white hat incentives. The motivation is to control bounty costs while maintaining a fixed supply narrative, but the speed of AI discovery has surpassed traditional manual audits.
Similar cases include the vulnerability Polygon faced in 2021 with a risk of about $24 billion, the $1.5 billion theft incident at Bybit, and some exchanges offering higher rewards for returned funds (such as approximately $410,000 ETH return reward). Currently, XRPL is transitioning from traditional consensus security to AI-assisted security, while the bounty mechanism has yet to upgrade accordingly.
Essentially, this reflects a shift in pricing power and regulatory changes: the incentive for vulnerabilities shifts from "good faith reporting for a fixed cap" to "attack profits and reporting profits being severely asymmetric." The mechanism lies in the misalignment of the treasury size and potential losses (which can reach 18 trillion XRP), leading to a decrease in reliance on white hat paths and an increase in reliance on black hat paths, ultimately affecting institutional trust pricing in the commitment to a fixed supply of the ledger.
ABAB News · Cognitive Law
- The bounty cap is the ceiling for white hats.
- The larger the treasury, the more incentives should be priced according to risk.
- When reporting profits are less than attack profits, good faith disappears first.