Crypto: an AI found a bug that could create 18 trillion XRP

Eighteen trillion XRP. In a single transaction, for a few hundred XRP as an initial stake. That's what a hacker could have created out of thin air on the XRP Ledger, the XRP blockchain, one of the ten biggest cryptos on the market. To give you an idea of the scale: there are only 100 billion XRP in total. The bug made it possible to create 184 times more than what exists!

Don't worry, nobody used it. It was found on September 21, fixed on the 25th, and made public on October 9 by the team that maintains the blockchain. And the craziest thing isn't the bug. It's who found it: an AI agent, meaning an AI that searches through code all by itself, from the small security company Veria Labs. The bug had been sleeping there since 2015.

An AI found the stop button before anyone found the money-printing machine

The odometer trick

The XRP Ledger has a little built-in exchange: people put up offers like “I’m selling this much XRP for this many digital dollars”, and a payment can go through several offers at once to find the best price. To know how much the buyer has to pay, the software adds up what each seller is asking for. So far, nothing magical.

Except that this addition happens in a fixed-size slot, and nobody checked whether it overflowed. You know the old odometer in cars? Once it reaches 999,999, it doesn't go to a million: it goes back to 000,000. In computing, that's called an overflow, and that's exactly what was happening here.

One more kilometer, and your old car is new again

With a few hundred offers that each asked for a huge amount of XRP, the total exceeded the size of the slot and fell back to a tiny number. Result: the buyer paid almost nothing, and each seller still received the full amount they were asking for. The difference? It came out of nowhere. Brand-new XRP, created out of thin air.

The cart full, the total at 3 cents, and the checkout saying thank you

The XRP Ledger did have a safeguard: an automatic check that verifies, after every transaction, that no XRP has been created. But this check did its calculations with the same unchecked addition. It was blind to exactly the problem it was supposed to catch. A smoke detector that only detects clean air, in short.

As someone who has been doing C# for twenty-five years, it gives me a little pang: integer overflow is the bug you learn about in the first programming classes. In C#, there's even a keyword, checked, that makes the calculation crash instead of quietly letting it fall back to zero. One line, and eleven years of risk gone.

Eleven years, a dozen audits, and nobody had seen a thing

This isn't a project abandoned in a corner. According to Veria Labs, the XRP Ledger code has undergone more than a dozen audits and security contests since 2024, including one with $550,000 in rewards up for grabs, and its researcher bounty programs have already distributed more than $1 million. Hundreds of pairs of human eyes have gone over it.

So why did no one? Cayden Liao, the co-founder of Veria Labs, has a solid explanation: the vulnerability “chains together two bugs that would each be low severity on their own”. On one side, the addition that overflows, on the other, the check that calculates the same way. Taken separately, you shrug. Put together, it's a money printer. Their AI agent searched through the code, spotted the two little flaws and understood that combining them produced a monster. A human on the team then checked that it really worked on the live network before sending the report.

The gray bar is all the XRP in the world. The red one is a single booby-trapped transaction

The reward: $250,000, the maximum for the program. “To our knowledge, this is the biggest bounty ever paid for a vulnerability discovered entirely by an AI agent”, says Liao. And he adds a detail that made me sit up: afterwards, they pointed ordinary code assistants straight at the faulty piece of code, and they still didn't find the bug. Well, it's a company talking about its own product, so I take that with a grain of salt. But the result is there, in black and white in the official report.

This isn't the first time this season, either. Five days ago, I told you how Anthropic's vulnerability-hunting AI had uncovered a bug that automated tests had skimmed over five million times without seeing it. AIs are becoming very good at finding what humans have looked at too often to still see.

Fixed in three days, without waiting for the vote

Normally, on the XRP Ledger, a change to the rules goes through a vote: the validators, those computers that check and approve transactions, have to support it by more than 80% for two weeks before it activates. It's democratic, it's cautious, and here it was dangerous: publishing the fix meant pointing out the vulnerability to every hacker in the world, two weeks before it was closed.

So the team did things differently, for the first time in more than ten years. The fix came out directly in version 3.4.1 of the software, on September 25, and the code was only published afterwards. More than 80% of the main validators had installed it that same day. Their justification, in the report: a short update period with limited risk was better than “weeks of a vulnerability known to everyone and wide open”. The accepted risk: during the transition, servers running different versions might no longer agree, and the blockchain could have frozen for a few moments. They preferred a shutdown to a money printer. I wholeheartedly agree.

And if you have XRP?

Nothing to do. No XRP was created, no funds were lost, and the XRP Ledger team says it found no trace of exploitation on the network. Your XRP on a platform or in your own wallet were never in direct danger. The real danger was surprise inflation: if a hacker had created thousands of billions of XRP and started reselling them, it was the value of all the XRP in the world that would have melted away, including yours.

The only case where you have something to do is if you run an XRP Ledger server yourself: version 3.4.1 is now the required minimum.

And what this story brings, deep down, is good news: AIs that find vulnerabilities don't work only for hackers. This one found the money printer, reported it, got its bounty, and the hole was plugged before anyone could use it. That's exactly how it should work.

One false note, pointed out by the Cointelegraph site: Veria talks about $94 billion put at risk, the entire value of XRP at $1.59, and gets $250,000. One quarter of one thousandth of a percent of the risk. For a $94 billion vulnerability, Ripple, the company behind XRP, gets away with a tip.

So to Veria Labs' agent: well done, you just earned more in one night than most developers do in three years. And to all the developers reading me: put a checked on your subtractions. It costs one line!

Sources

• XRP Ledger, October 9, 2026: official report on the two bugs fixed in xrpld 3.4.1
• GitHub: version 3.4.1 of the XRP Ledger software
• The Block, October 11, 2026: 18,000 billion XRP, 184 times the total supply, $250,000 bounty
• Bitcoin.com News, October 10, 2026: how the bug worked and the timeline for the fix
• Cointelegraph: $94 billion at stake, $250,000 bounty

Article written with the help of Claude Code, proofread and corrected by me.