AI discovers XRP Ledger flaw that could mint 18 trillion tokens and put $94 billion market at risk

The decade-old vulnerability escaped years of security reviews and forced XRP Ledger
(XRPL) developers to bypass established governance procedures.

An AI agent uncovered a decade-old XRPL bug that could create trillions of XRP, prompting an emergency fix.

The vulnerability could have let an attacker generate about 18 trillion XRP through a single payment transaction, roughly 180 times the cryptocurrency's original 100 billion token supply, according to security firm Veria Labs.

Veria founder Cayden Liao said the flaw potentially threatened XRP's $94 billion market capitalization by undermining the cryptocurrency's fixed supply.

The vulnerability was reported on Sept. 22 and patched three days later. RippleX later confirmed that no unauthorized XRP was created, no funds were lost, and investigators found no evidence of exploitation on public networks. The incident was publicly disclosed on Oct. 9.

The discovery emerged from Veria's AI-powered security system, which analyzed rippled, the software underpinning XRPL, and identified two weaknesses that could be combined to bypass its monetary safeguards.

The first involved an integer overflow in the payment engine, where deliberately constructed trading offers could cause the system to miscalculate the amount a buyer owed.

Under the exploit, sellers would receive their full XRP payments while the buyer would be charged only a fraction of the actual amount. The difference would effectively create XRP that had never existed.

A second vulnerability affected the network's supply-protection mechanism. Because it relied on the same flawed arithmetic, it could fail to recognize that new XRP had been created.

The attacker would need to prepare hundreds of accounts and trading offers before submitting the payment. According to the official vulnerability report, the attack required only a few hundred XRP in largely refundable reserves and ordinary transaction fees.

The underlying payment-engine code dates to 2015, while the affected supply safeguard was introduced in 2017.

That longevity is particularly significant given the network's security history.

Liao said the XRPL codebase had undergone more than a dozen audits and security contests since 2024, including one competition with a $550,000 prize pool. Its bug bounty programs had also distributed more than $1 million.

Despite those efforts, the combined vulnerability remained undetected until Veria's AI system identified it, assembled a working exploit, and demonstrated the problem on a local network.