One payment could have created about 18 trillion XRP, roughly 184 times the supply the XRP Ledger was built around. That is the estimate of Cayden Liao, co-founder of the AI security startup Veria Labs, whose agent found the flaw and built a working exploit, The Block reported.
The bug had been in the payment engine since 2015. When one payment filled many order book offers at once, the total had no overflow check, so a big enough sum wrapped round to a small one. An attacker could have listed tiny token amounts at huge XRP prices, then closed every offer in one payment.
Veria reported it on 22 September. RippleX shipped a fix in version 3.4.1 three days later, and more than 80 per cent of validators on the default list had it that day. It skipped the usual amendment vote, a first in over ten years.
Public disclosure came on 9 October, with no evidence of exploitation on any public network. Liao said Ripple paid its top bounty of $250,000, likely the largest for a bug found entirely by an AI agent, to his knowledge.
The secrecy drew criticism. Source code for the release appeared two weeks after the binaries, and the investor Justin Bons said XRP had been running closed code meanwhile. A RippleX engineer replied that a critical patch hidden in a routine release would be spotted and reverse-engineered quickly.
No evidence of exploitation is a weaker claim than no exploitation. The ledger’s own supply check shared the flaw, so nothing would have raised an alarm. RippleX will expand AI-assisted bug hunting. What it cannot say is whether someone else’s agent reached the same bug first.
