A single integer overflow in the XRP Ledger's payment engine, present in production code since 2015, could have allowed an attacker to mint approximately 18.45 trillion XRP in one transaction — 184 times the token's fixed 100 billion supply cap. At XRP's current market capitalization of $86 billi...
"It found both bugs, worked out how to chain them together, and built a working exploit on a local network to prove it." — Cayden Liao, Co-founder, Veria Labs
A single integer overflow in the XRP Ledger's payment engine, present in production code since 2015, could have allowed an attacker to mint approximately 18.45 trillion XRP in one transaction — 184 times the token's fixed 100 billion supply cap. At XRP's current market capitalization of $86 billion, the potential counterfeit supply dwarfed the entire legitimate token economy.
The flaw was discovered not by a human auditor but by an autonomous AI security agent built by Veria Labs, a firm co-founded by researcher Cayden Liao. Veria reported the vulnerability through the XRPL Bug Bounty program on September 22, 2026. RippleX shipped a fix in xrpld 3.4.1 three days later, on September 25. The official vulnerability disclosure report was published on October 9. Veria received the program's maximum critical bounty of $250,000 on October 8 — the largest payout on record for a vulnerability discovered entirely by an AI agent.
XRP's price reaction was notably muted: the token held near $1.39 with sub-1% daily movement following disclosure, suggesting the market priced in the fix-before-disclosure timeline as risk-mitigating.
The XRP Ledger processes payments through an internal offer-matching engine that aggregates amounts across multiple DEX offers during a single transaction. The flaw resided in the arithmetic that summed these amounts.
When an attacker constructed a set of specially crafted offers and routed a single payment through them, the running total of XRP amounts could exceed the maximum value representable by the integer data type. Instead of producing an error, the sum wrapped around to a small value. The payment engine then charged the buyer only the wrapped (small) total, while paying each offer owner their full, individual amount. The difference — approximately 18.45 trillion XRP in the demonstrated exploit — constituted newly created tokens that violated the ledger's supply invariant.
Critically, the vulnerability was compound. A second flaw affected the "no XRP created" invariant checker, which was designed as a safety net to catch exactly this type of supply violation. That checker used the same arithmetic and was susceptible to the same overflow, meaning it would fail to detect the unauthorized minting. The attacker would have received spendable XRP indistinguishable from legitimately circulating tokens.
The code containing both flaws dated to 2015, when the current payment engine was written. It survived over a decade of human code reviews, multiple third-party audits, and 107.6 million ledger closings without detection.
| Date | Event | |------|-------| | 2015 | Vulnerable code introduced in XRPL payment engine | | Sep 21, 2026 | Veria Labs' AI security agent identifies the overflow | | Sep 22, 2026 | Cayden Liao validates finding, files report via XRPL Bug Bounty | | Sep 22–25 | RippleX engineers reproduce the exploit on a standalone server, confirm minted XRP is spendable in subsequent transactions | | Sep 25, 2026 | xrpld 3.4.1 released; described publicly as "assorted integer-arithmetic hardening" | | Sep 25, 2026 | 80%+ of UNL validators upgrade same day | | Oct 8, 2026 | Veria Labs receives $250,000 maximum critical bounty | | Oct 9, 2026 | Full vulnerability disclosure report published by XRPL Foundation | | Oct 9–13, 2026 | XRP price holds at $1.39, sub-1% daily movement; trading volume rises ~40% |
The three-day window between report and patch is notably fast. RippleX's internal process — reproduce, verify exploitability, develop fix, test, and release — compressed into 72 hours.
The discovery marks a threshold event in blockchain security. According to Liao, Veria's team pointed a purpose-built AI security agent at rippled, the C++ software that runs the XRP Ledger. The agent independently identified both the payment-engine overflow and the invariant-checker bypass, determined how to chain them into a single exploit, and constructed a working proof-of-concept on a local test network.
What makes this case significant: after the disclosure, Veria pointed general-purpose coding agents at the same vulnerable code. They could not find the flaw. The implication is that the bug's detection required domain-specific security reasoning that general-purpose language models lacked, but that a purpose-built agent could deliver.
This aligns with broader 2026 data on AI security capabilities. According to research from Anthropic, purpose-built AI security agents detected vulnerabilities in 92% of 90 previously exploited DeFi contracts worth $96.8 million in aggregate — nearly three times the 34% detection rate achieved by baseline coding agents. Separately, OpenAI and Paradigm's EVMbench benchmark found that the top-performing model (GPT-5.3-Codex) successfully exploited 72% of 120 real-world smart contract vulnerabilities drawn from 40 security audits.
The $250,000 bounty paid to Veria is, according to Liao, the largest ever paid for an AI-discovered vulnerability. For context, the cost of running an AI agent against a smart contract currently sits at approximately $1.22 per contract according to Halborn, a blockchain security firm. The economics of automated vulnerability hunting are shifting rapidly.
The XRP Ledger's governance model requires protocol changes to pass through an amendment process: a proposed change must receive support from more than 80% of validators on the default Unique Node List (UNL) for two consecutive weeks before activation. This process is designed to prevent unilateral changes and give operators time to review code.
For the first time since the amendment system was introduced over a decade ago, XRPL bypassed this process entirely. The severity of the vulnerability — the ability to arbitrarily inflate supply — meant that following the standard two-week voting window would have exposed the flaw to potential exploitation before sufficient validator coverage was in place.
Instead, the fix was shipped as a direct software upgrade. Validators were urged to install xrpld 3.4.1 immediately. Over 80% complied on the same day, September 25. The patch became effective as validators upgraded, without a formal amendment vote.
This sets a precedent. The XRPL community now has a documented case where emergency security requirements overrode established governance procedures. Whether this precedent constrains or enables future bypasses remains an open question for the network's governance framework.
The payment-engine overflow is the second critical vulnerability disclosed on the XRP Ledger in 2026. The first, identified on February 19 by Pranamya Keshkamat and Cantina AI's Apex tool, involved a logic flaw in the signature-validation logic of the Batch amendment. That bug allowed an attacker to execute transactions on behalf of arbitrary accounts without their private keys.
| Vulnerability | Date Found | Discovered By | Severity | Status at Discovery | |---|---|---|---|---| | Batch amendment signature bypass | Feb 19, 2026 | Cantina AI (Apex) + Pranamya Keshkamat | Critical | Pre-activation (voting phase) | | Payment engine integer overflow | Sep 22, 2026 | Veria Labs AI agent + Cayden Liao | Critical | Live in production since 2015 |
A notable pattern: both critical 2026 vulnerabilities were discovered by AI-assisted security tools, not human auditors. The February flaw was caught during the voting phase before mainnet activation, limiting potential damage. The September flaw had been live and exploitable for 11 years.
The Batch amendment flaw prompted an emergency release (rippled 3.1.1) on February 23, and UNL validators were advised to vote "No" on the amendment. A corrected replacement, BatchV1_1, was subsequently developed and audited. A Sherlock audit of the corrected code reportedly identified 96 bugs before deployment.
XRP's market response to the October 9 disclosure was subdued. The token traded at approximately $1.39 on Sunday, October 12, with daily changes remaining below 1%. Trading volume increased approximately 40%, suggesting heightened attention without panic selling.
Several structural factors likely contributed to the muted reaction:
For context, XRP's market cap stood at approximately $86 billion at time of disclosure. The token ranked fifth among cryptocurrencies with roughly 3% market share. On-chain, the XRPL recorded 2.47 million daily transactions with 39,076 active addresses. The network's DeFi TVL sat at approximately $41 million according to DefiLlama, with stablecoin value on-chain reaching $1.159 billion, led by RLUSD at 92.1% share.
The XRPL case crystallizes a broader shift in blockchain security economics observed throughout 2026. AI agents are moving from supplementary audit tools to primary discovery mechanisms for certain vulnerability classes.
According to Halborn, offensive exploit capabilities in AI agents are doubling every 1.3 months. The defensive side is keeping pace: purpose-built security agents now detect at rates approaching human auditor performance for known vulnerability patterns. However, researchers at both OpenAI and Anthropic note that no AI agent has yet demonstrated consistent end-to-end exploitation capability across all test cases. The technology reliably catches well-documented patterns but, according to the researchers, "cannot replace human judgment."
The economic calculus is stark. A human-led audit of a complex protocol costs $50,000 to $500,000 and takes weeks to months. An AI agent scan costs approximately $1.22 per contract. The XRPL vulnerability, which survived 11 years of human review, was found by machine in a directed scan. The $250,000 bounty returned represents a fraction of the potential damage — had an attacker minted even a small fraction of the 18.45 trillion possible XRP and liquidated before detection, losses could have reached billions.
This does not eliminate the need for human auditors. The February Batch amendment flaw required understanding of the amendment voting lifecycle — context that purpose-built agents like Cantina's Apex tool could incorporate but general agents could not. The September overflow required understanding of payment-engine semantics at a level that, per Veria, general coding agents failed to reach even when pointed directly at the vulnerable code.
The emerging model is hybrid: AI agents as first-pass discovery tools with high coverage and low cost, human experts for contextual verification and novel vulnerability classes.
The XRP Ledger's payment-engine overflow is among the most consequential vulnerabilities ever discovered in a major blockchain — not for damage inflicted, since none occurred, but for damage potential. An 18.45 trillion token mint on a network with $86 billion in market capitalization would have constituted the largest possible single-transaction exploit in cryptocurrency history.
That it was discovered by an AI agent, not a human auditor, after 11 years in production code, marks a practical milestone for automated security. The hybrid model — machine discovery, human verification, coordinated validator response — worked. Whether it will continue to work as AI capabilities accelerate on both offensive and defensive sides is the operative question for every protocol team managing legacy codebases.
The XRPL's governance framework absorbed the shock, but not without precedent-setting action. Bypassing the amendment process to ship an emergency fix was necessary and effective. It was also the first time it happened. The next critical vulnerability will test whether the precedent enables faster response or erodes governance legitimacy.