An AI-powered security system uncovered a decade-old vulnerability in the XRP Ledger that could have allowed an attacker to create approximately 18 trillion XRP in a single payment transaction, according to reporting by CryptoSlate.
The potential exploit was equivalent to roughly 180 times the ledger’s original supply of 100 billion XRP. Veria Labs, the security firm that identified the issue, said the flaw could have undermined confidence in XRP’s fixed-supply model and put the cryptocurrency’s reported $94 billion market capitalization at risk.
The vulnerability was reported on Sept. 22 and fixed three days later. RippleX subsequently said that no unauthorized XRP had been created, no funds had been lost and investigators had found no evidence that the exploit had been used on public networks. The incident was disclosed publicly on Oct. 9.
Two weaknesses combined into one potential exploit
Veria’s AI security agent examined rippled, the software that operates the XRP Ledger, and found two separate weaknesses that could work together to bypass safeguards designed to protect the network’s monetary supply.
The first was an integer-overflow problem in the payment engine. Integer overflow can occur when software calculations exceed the range that a system can correctly represent, causing the resulting value to be misread. In this case, specially constructed trading offers could make the ledger calculate that a buyer owed far less XRP than the actual amount.
Under the proposed exploit, sellers would still receive their full XRP payments, while the buyer would be charged only a fraction of the amount. The gap between those figures would effectively represent newly created XRP.
The second weakness affected the ledger’s supply-protection mechanism. That safeguard relied on the same flawed arithmetic and could therefore fail to identify that additional XRP had been generated.
An attacker would have needed to prepare hundreds of accounts and trading offers before sending the payment transaction. The official vulnerability report said the preparation required only a few hundred XRP in mostly refundable reserves, along with standard transaction fees.
The affected payment-engine code dated back to 2015, while the supply safeguard had been introduced in 2017. Veria founder Cayden Liao said the codebase had been subject to more than a dozen audits and security contests since 2024, including a competition with a $550,000 prize pool. Bug-bounty programs had also paid more than $1 million.
Veria’s system not only identified the combined weaknesses but also assembled a working exploit and demonstrated it on a local network. RippleX engineers independently reproduced the result and confirmed that the newly generated XRP could be spent in later transactions.
Veria received a $250,000 reward, the maximum available under the relevant bounty program. Liao described it as the largest known reward for a vulnerability found entirely by an AI agent.
Developers bypass normal amendment process
The scale of the threat led XRPL developers to take an unusual step. Rather than use the ledger’s established amendment process, RippleX, the XRP Ledger Foundation and network validators coordinated an emergency software upgrade.
Under normal procedures, a change to transaction-processing rules must receive support from more than 80% of trusted validators for two consecutive weeks before it can take effect. Developers concluded that waiting through that process could leave the flaw open for exploitation.
There was also a disclosure risk. Because the XRP Ledger software is open source, releasing the repair before it was active could have made it easier for attackers to understand and exploit the weakness.
The protection was instead activated immediately on servers running version 3.4.1. The first distribution used binaries, while the source code was temporarily withheld to reduce the possibility of reverse engineering during deployment.
The disclosure described the move as the first deliberate bypass of the amendment-activation process for a transaction-processing change in more than a decade. Such a step also created a risk of its own: servers running different software versions might disagree about whether a transaction was valid, potentially affecting consensus or stopping the network.
Developers judged that a temporary interruption would be preferable to allowing counterfeit XRP into circulation. More than 80% of validators on the default trusted-validator list had upgraded by Sept. 25, materially lowering the risk of incompatible network versions. The XRP Ledger Foundation later established version 3.4.1 as the minimum required software version after separate Batch-related amendments were activated on Oct. 9.
RippleX expands AI testing and formal verification
The incident has led RippleX to reassess how it reviews older parts of the XRP Ledger. J. Ayo Akinyele, RippleX’s head of engineering, said the discovery showed that longstanding assumptions about the network’s design needed to be revisited.
RippleX plans to expand AI-assisted vulnerability searches, increase adversarial testing and examine legacy components more closely. The review will include the payment engine, consensus mechanisms and peer-to-peer networking.
The organization also intends to accelerate formal verification, a mathematical method used to establish whether software satisfies defined security properties. That work will build on existing verification efforts involving the XRPL Lending Protocol and Single Asset Vault, with CommonPrefix and the XRP Ledger Foundation.
The disclosure also changed the way security findings are closed. Issues previously marked as resolved must now be tested again against release candidates before they can be formally classified as complete.
Current XRP market picture
Moneyiar market data recorded at 11:53 a.m. on Oct. 11, 2026, shows XRP at $1.3927345555. The token was down 0.8% over 24 hours and 7.06% over seven days. The source material placed XRP at number five by market capitalization and reported a 1.08% 24-hour decline.
The discovery did not result in unauthorized XRP creation or reported losses, but it highlights the importance of software controls behind a cryptocurrency’s supply rules. It also illustrates how AI-based security tools are being used to test established blockchain infrastructure for weaknesses that conventional audits may not uncover.
