AI-found flaw in XRP Ledger could have minted 18 trillion XRP; foundation says supply unchanged at 100 billion
A decade-old XRP Ledger flaw found by Veria AI could have minted 18.45 trillion XRP in one transaction; it was patched and the XRP Ledger Foundation says no new tokens were created.
Why it matters
A mint bug on a ledger whose entire value rests on a hard 100 billion supply cap is the kind of defect that, if exploited, would have hit market capitalisation rather than a contract balance. It was patched before any token was created, so no supply changed. The size of the bounty and the gap between XRPL developers and outside security researchers over that payout are now part of the public argument about the network's security model.
Key facts
Veria AI, a vulnerability-detection system from Veria Labs, identified the flaw on Sept. 21 and researchers filed a bug report through the XRP Ledger bug bounty program the next day.
Reported by U.Today
The vulnerability would have allowed attackers to mint 18.45 trillion XRP through a single transaction, over 184 times the initial supply, and the new tokens could have been spent and transferred to exchanges.
18,450,000,000,000 XRPReported by U.Today
RippleX senior director of engineering J. Ayo Akinyele said the bug had existed in the XRP Ledger codebase for over a decade and could have allowed XRP to be created beyond its fixed supply.
Reported by Bitcoin.com News
The fix shipped on Sept. 25 and investigators found no evidence that the vulnerability was exploited.
Reported by Bitcoin.com News
Security researchers estimated the vulnerability could have affected XRP's whole market capitalisation, which they put at about $94 billion when they filed the report.
94,000,000,000 USDReported by U.Today
Ripple paid the white-hat researchers behind the disclosure a $250,000 reward, which blockchain sleuth ZachXBT criticised as too small and argued it discourages future bug reports.
250,000 USDReported by Bitcoin.com News
RippleX engineer Mayukha Vadari said AI changes how critical bugs get discovered and that a critical bug patch can no longer be slipped into a regular public release without being reverse engineered.
Reported by U.Today
What happened
Veria AI, an automated vulnerability-detection system built by Veria Labs, identified a flaw in the XRP Ledger on Sept. 21 and filed a bug report through the ledger's bug bounty program the next day, which U.Today and Bitcoin.com News reported. Researchers said the vulnerability would have let an attacker mint 18.45 trillion XRP in a single transaction, 184 times the fixed supply of 100 billion, and the newly minted tokens could have been spent and sent to exchanges. RippleX senior director of engineering J. Ayo Akinyele said the bug had been in the codebase for over a decade, that the fix shipped on Sept. 25, and that investigators found no evidence of exploitation. The XRP Ledger Foundation said the bug created no new XRP, that supply is still fixed at 100 billion since launch with almost 99.986 billion circulating after transaction-fee burns, and that the issue was resolved in the 3.4.1 upgrade. Ripple separately paid the researchers a $250,000 bounty, which the blockchain sleuth ZachXBT criticised as too low to deter attackers. RippleX engineer Mayukha Vadari separately warned about AI-assisted attacks on blockchain software, and Avalanche founder Emin Gün Sirer said AI will find system-level bugs long before ECDSA is superseded, without naming a specific unpatched XRP Ledger flaw.
How the story developed
- Update
Flaw found by Veria AI on Sept. 21
Veria AI, built by Veria Labs, identified the vulnerability; researchers filed a bug report through the XRP Ledger bug bounty program the next day.
- Resolution
Fix shipped Sept. 25
The fix for the minting flaw was coded and released; the XRP Ledger Foundation later cited the 3.4.1 upgrade as resolving the issue.
- First report
First report by U.Today
XRP Ledger Might Be Vulnerable to AI, Avalanche Founder Warns
- Independent corroboration
Independently corroborated by CryptoSlate
XRP Ledger lets institutions share account duties without sharing their keys
- Official statement
RippleX sets out security response on Oct. 10
RippleX senior director of engineering J. Ayo Akinyele said on X that the bug had existed for over a decade, that the fix shipped and no exploitation was found, and that Ripple is expanding simulated attacks and mathematical protocol checks.
- Official statement
Vulnerability details publicly unveiled
XRP Ledger developers publicly detailed a flaw that had been present for a decade and could have allowed minting beyond the fixed 100 billion supply.
- Official statement
Official statement from Bitcoin.com News
Ripple Responds to Critical XRP Bug That Threatened Fixed Supply
- Correction
Correction published by CoinGape
XRP News: XRP Ledger Foundation Clarifies 100B Supply Remains Safe Amid Security Fix
- Official statement
XRP Ledger Foundation says no XRP was created
The foundation said the bug produced no additional tokens, supply is unchanged at 100 billion since launch, and the issue is fixed in the 3.4.1 upgrade.
- Update
ZachXBT criticises the $250,000 bounty
The blockchain sleuth called the reward to the disclosing researchers cheap and said low payouts discourage future bug reports.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 9 Oct 2026, 18:33 UTC: U.Today — 1 independent source, 1 reports
- 9 Oct 2026, 20:00 UTC: CryptoSlate — 2 independent sources, 2 reports
- 11 Oct 2026, 06:34 UTC: U.Today — 3 independent sources, 3 reports
- 11 Oct 2026, 08:08 UTC: Bitcoin Insider — 4 independent sources, 4 reports
- 11 Oct 2026, 10:05 UTC: Crypto.News — 5 independent sources, 5 reports
- 12 Oct 2026, 02:05 UTC: Bitcoin.com News, official — 6 independent sources, 7 reports
- 12 Oct 2026, 06:48 UTC: CoinGape — 7 independent sources, 9 reports
- 14 Oct 2026, 05:24 UTC: CoinDesk — 8 independent sources, 14 reports
- 14 Oct 2026, 06:15 UTC: Crypto News Flash — 9 independent sources, 16 reports
- 14 Oct 2026, 07:36 UTC: BTC-ECHO — 10 independent sources, 17 reports
- 14 Oct 2026, 10:32 UTC: Unchained — 11 independent sources, 18 reports
Affected entities
Also mentioned: Binance, Coinbase, Mastercard, Nasdaq, Solana, Vitalik Buterin, BNB
Original sources
Related events
Bitcoin Rallies From $75,000 to Over $84,000 as Crypto Market Cap Hits $2.87 Trillion
Bitcoin rebounded from a weekly low of $75,000 to exceed $84,000, driving over $450 million in short liquidations and lifting total crypto market capitalization to $2.87 trillion.
Solana Leads RWA Net Flows With $348 Million in 30-Day Period
Solana attracted $348 million in net real-world asset flows over a 30-day period, leading all tracked blockchain networks.
Goldman Sachs Offers FTIXX Treasury Fund Through Lynq Without Tokenizing It
Goldman Sachs is distributing its Financial Square Treasury Instruments Fund (FTIXX) through Lynq, a settlement network, with tZERO Securities handling trades and no tokenized version.
NYSE Parent ICE Evaluates Avalanche as Blockchain for 24/7 Tokenized Stock Trading
ICE is evaluating Avalanche to power an alternative trading system for 24/7 tokenized securities settlement, but no final selection has been made.
AVAX jumps nearly 50% in a week on tokenization news, then gives back 8% after Helicon
AVAX rose nearly 50% in a week to an eight-month high of $10.82 on institutional tokenization news and Helicon, then fell more than 8% a day after the upgrade.
Hyundai Card Weighs Scaling Avalanche Stablecoin Pilot After Cross-Border Test
U.Today reports Hyundai Card moved about $20,000 in USDT over Avalanche between two Hyundai affiliates in roughly seven minutes and is weighing a wider rollout.