A 2015 bug in XRP Ledger and the end of artisanal auditing

On 22 September 2026, Veria Labs reported an arithmetic overflow in the XRP Ledger’s payment engine to RippleX. Three days later, on the 25th, RippleX shipped version 3.4.1 of xrpld, and by that same day more than 80% of the validators on the default Unique Node List were already running it. The flaw had been in the code since 2015. According to the disclosure report covered by The Block, there is no evidence it was ever exploited on a public network.

Cayden Liao, Veria’s co-founder for security, says it was an AI agent that found the bug and built the working exploit. By his calculations, a single transaction could have created some 18 trillion XRP: 184 times the network’s total supply, which was fixed at 100 billion at launch and declines as fees are burned. Ripple paid out the maximum bounty under its programme, $250,000.

The mechanism: two minor bugs that together are worth a network

The XRPL payment engine lets a single payment consume multiple order-book offers at once. The sum of those offers had no overflow check: a large enough total would wrap around and turn into a small number. The attack described in the report involved opening a few hundred accounts, having each one list a minuscule fraction of a token in exchange for a huge amount of XRP, and then closing all of those sales with a single payment. Every selling wallet got paid in full; the buyer paid “just a few hundred drops plus the fee”.

The piece that turns an accounting error into a systemic failure is the second one: the check the network runs precisely to prevent new XRP from being created added up balances with the same defect. The guard had the same hole as the gate. As Liao wrote, “we suspect one reason nobody caught this vulnerability is that it chains two bugs that would individually be low severity”.

That is the interesting data point, not the 18 trillion. A decade of human audits, by Ripple’s own reviewers and by third parties, went over that code without seeing it, because each half of the problem was individually boring. Human review works by module and by hypothesis: you audit the payment engine, you audit the issuance check, and you rarely model the joint state of the two under inputs no rational operator would ever generate. The report itself makes the point: “The attack could not be triggered by accident. It required hundreds of offers at prices no real trader would use”. That is exactly what an agent exploring the state space with no boredom cost will do.

The asymmetry nobody has repriced

The XRP Ledger’s bounty programme caps out at $250,000. That is a high figure by industry standards and a ridiculous one against what was at stake. Estimates that have circulated put the notional value of the mintable XRP at around $94 billion, which leaves a ratio of roughly 1 to 376,000 between what the person who reports gets paid and what the person who doesn’t report could capture.

That notional figure deserves a large asterisk, and I will come back to it. But the structural problem doesn’t depend on the exact number. Bug bounty programmes were designed when finding a critical flaw in a live chain was an artisanal act, scarce and slow: months of work by a specialist who, on top of that, had few alternative buyers. The price reflected the scarcity of supply, not the value of the asset being protected. AI has just shifted the supply curve: the marginal cost of running an agent over a decade-old codebase tends to zero, and the same agent is available to anyone who would rather sell in another market.

Recent weeks show that the other market exists and settles well. Ledger confirmed an unauthorised hardware implant in at least one device distributed by the reseller CryptoBilis, with losses estimated by on-chain investigators at between $86 million and $93 million across more than 300 wallets. In July 2026, a flaw in Coldcard’s seed-generation firmware allowed $100 million to $130 million in bitcoin to be drained. These are operations that require physical logistics or compromised supply chains, and even so they yield two orders of magnitude more than the maximum bounty in most disclosure programmes. A remote, reproducible exploit with no physical contact yields more.

The operational conclusion is uncomfortable: if the cost of discovery falls for everyone at once, the only instrument left to steer a finding towards responsible disclosure is price. And price is still anchored to 2019 economics.

The patch that skipped governance

On the XRP Ledger, rule changes normally go through an amendment process: a proposal needs the support of more than 80% of trusted validators sustained over two weeks. This fix did not. It took effect server by server, as each operator upgraded, and the report acknowledges it is the first time in more than ten years of amendments that this has happened. On top of that, the source code for 3.4.1 was published roughly two weeks after the binaries. Justin Bons of Cyber Capital put it bluntly: “XRP has been running closed-source code for the past two weeks”.

The response from RippleX engineer Mayukha Vadari is the most relevant argument in the whole story: “AI has changed things. You can’t slip a critical bug fix into a routine public release process, it will be spotted and reverse-engineered immediately”. J. Ayo Akinyele, head of engineering, announced that they will expand AI-assisted bug hunting and formal verification. The defence of the emergency patch has turned into a public debate inside the ecosystem.

Vadari is right on the technical diagnosis, and that is why the problem is worse than it looks. For fifteen years, open source has operated with an implicit window between the publication of a patch and mass exploitation: the time it took a human attacker to read a diff and work out what it fixed. That window has closed. If any agent can diff two versions and reconstruct the exploit in minutes, classic coordinated disclosure stops working, and the alternative is what RippleX did: binaries first, source later, and a de facto upgrade with no vote.

What that reveals is not a conspiracy but a capability. Someone was able to move more than 80% of the default UNL validators in seventy-two hours, without going through the governance mechanism designed for exactly that purpose. That capability is an extremely valuable security asset — without it, the flaw would have been exposed for weeks — and simultaneously the most concrete risk vector in the entire network. It is the question that ought to be occupying anyone drafting rules on the tokenisation of securities and commodities: not how many nodes there are, but who can change the settlement rules in three days and under whose supervision. In a network that aspires to settle real-world assets, emergency patching power is, functionally, an intervention power. Nobody has registered it as such.

What would falsify this reading

Several things, and they are worth stating. First: the $94 billion is notional, not realisable. Minting 18 trillion XRP destroys the price of XRP in the same block; the real extractable value would be a very small fraction of that figure, limited by exit liquidity on exchanges and by the very high probability of a social rollback of the chain. The 1:376,000 asymmetry is rhetorically powerful and economically imprecise. What remains true is that the reputational damage would be terminal even if the attacker walked away with nothing.

Second: “an AI found it” is a hard claim to verify and a commercially useful one for a security startup. We don’t know how much human direction went into the prompt, into picking the module, or into building the exploit. It is plausible that the agent was the accelerant for a prior human intuition, which is a considerably less saleable headline.

Third: XRPL’s validator concentration is not a revelation. It is a known property, criticised for years. The emergency patch does not create it, it merely makes it visible at a moment when the question becomes regulatory.

And fourth: the false positive rate remains to be seen. An agent that flags two hundred findings of which one is real shifts cost onto the engineering team, it does not reduce it. The XRPL case is, for now, an observation, not a statistical series.

Defence is being redesigned at the wrong layer

Meanwhile, the dominant conversation about AI and crypto security is going somewhere else. Justin Drake of the Ethereum Foundation warned that AI-driven mathematics could break ECDSA signatures before quantum computers do, “in the worst case in months, not years”, and Vitalik Buterin has said he finds it “plausible” that it happens within two years. Zakura, which is building a full Zcash node, expects post-quantum signature opcodes in January, with hash-based signatures (WOTS) for transparent payments, address rotation after every transaction and private information retrieval in the Vizor wallet so the server cannot link addresses belonging to the same user.

This is serious and necessary work. But note the mismatch: the industry is redesigning the cryptographic layer against an adversary with massive compute, while the execution layer — the code that decides how much gets paid to whom — is still 2015 C++ audited by humans. On the XRP Ledger nobody needed to break an elliptic curve. All it took was an integer that wrapped around. The AI adversary is not going to start with the hard mathematics: it is going to start with the ten million lines of business logic accumulated over the past decade, where the cost of searching is now close to zero and the reward for finding is the same as ever.

What to do with this if you build or invest

If you run a protocol in production with code written before 2022, assume there are findings pending and that someone is going to find them this year, with or without your permission. Three concrete decisions:

• Index the bounty cap to value at risk, not to the security budget. A fixed $250,000 cap on a network holding billions is a price signal that pushes the finder towards the other market. Percentage scales with a floor and a high ceiling are defensible in front of a board; a round number inherited from 2019 is not.
• Write your disclosure policy now for a world with no patching window. The binaries-first, source-later sequence stops being a breach of the spirit of open source and becomes an operational decision that has to be justified in advance, not after the fact and under fire. Document the threshold that triggers the emergency procedure and who declares it.
• For investors: ask who holds the patch key. In due diligence on any network that aspires to settle tokenised assets, the emergency upgrade time and the list of people who can coordinate it are worth more than the validator count. If nobody can move 80% of the network in seventy-two hours, the next critical flaw stays open for weeks. If somebody can, that person or company is a concentration risk that still doesn’t appear in any memo.