AI Discovers Major Network Flaw Hidden For Ten Years

An artificial intelligence security system and a human researcher uncovered a critical ten-year-old counting vulnerability in the XRP Ledger that could have generated trillions of non-existent tokens. The flaw, which went unnoticed by human reviewers for a decade, was discovered on September 22, 2026.

Researcher Cayden Liao and Veria AI from the security firm Veria Labs found that a counting error allowed a single payment to purchase multiple trading offers simultaneously. Sellers received full payment while the buyer was charged almost nothing, bypassing safety checks due to the same faulty code. This flaw could have minted 18.45 trillion XRP out of thin air, an amount far exceeding the network's original total supply of 100 billion coins.

Ripple’s engineering division, RippleX, found no evidence that malicious actors exploited the vulnerability. The XRP Ledger Foundation noted that triggering the bug required hundreds of intentionally constructed operations, meaning ordinary payments would never encounter it. The foundation maintains that no artificial tokens were created, pointing out that about 99.986 billion XRP exist today since transaction fees are continually destroyed.

Emergency Protocol Shift

The discovery prompted engineers to bypass their standard public release processes. For the first time in over ten years, developers skipped the usual amendment voting process, which typically takes weeks for validators to conclude. Instead, they released ready-to-run binaries for version 3.4.1 prior to sharing the underlying source code. Over 80% of trusted validators implemented the patched software on its release day. Public binaries were ultimately released on September 25.

The decision to temporarily hide the source code was driven by the speed at which attackers can use machines to analyze code changes. RippleX engineer Mayukha Vadari detailed why the network altered its patching strategy.

"Things have changed with AI. You can’t just sneak in a critical bug patch in a regular public release process, because you’re going to get caught and reverse-engineered right away," Vadari stated.

The network bug adds to a series of long-hidden security weaknesses surfaced by AI since July. Similar AI discoveries involved Bitcoin, including a flaw in the Coldcard hardware wallet linked to the theft of at least 1,367 Bitcoin, alongside vulnerabilities within the Core Lightning transaction software.

Bounty Payout Backlash

Despite the rapid patch, the XRP Ledger Foundation is facing strong criticism from the crypto community over its bounty payout. Critics argued the reported $250,000 reward is an absolute joke given the catastrophic nature of the bug, which risked a market value of about $94 billion at the time of the report.

Community members warned that insufficient payouts might incentivize future hackers to exploit vulnerabilities rather than disclose them responsibly. One critic stated the foundation must pay bug finders well to prevent attackers from taking the cheaper option. In response to the backlash, the foundation thanked Liao and Veria AI for their responsible reporting and promised stronger testing alongside a larger bug bounty program.