Skip to content
Today
Sign in

InvestIndependently confirmed2 publishers3 min readPublished

Ripple's $250,000 bounty equals 0.0003% of the XRP value Veria says the bug put at risk

Ripple paid Veria Labs the $250,000 program maximum for an XRP Ledger bug that could have minted about 18.45 trillion XRP. ZachXBT called the sum too small and warned it could tempt the next finder to exploit instead of report.

The Investor · Invest desk

How we use AISend a correction

Illustration accompanying Ripple's $250,000 bounty equals 0.0003% of the XRP value Veria says the bug put at risk
Generated illustration
Veria says nearly all XRP's value was at risk Veria's estimate of the value at risk and what the bug could mint, beside the Zcash award ZachXBT cited as a precedent.

Key figures: XRP's $94 billion market value, which Veria says was nearly all at risk; about 18.45 trillion XRP the bug could have minted, about 184 times the fixed 100 billion supply; and the $1.5 million Zcash awarded Taylor Hornby, cited by ZachXBT.

Veria says nearly all XRP's value was at risk
FigureValueNoteClaim
XRP market value Veria says was nearly all at risk94 billion USD12
Could have minted, about18.45 trillion XRP3
Times fixed supply, about184 times4
Zcash award to Hornby1.5 million USD14

What happened

  • Veria reported the flaw on September 22, RippleX confirmed it the same day, and the fix shipped in xrpld 3.4.1 on September 25.
  • In a proof of concept, Veria's AI agent chained two bugs written in November 2015 and February 2017 and credited the XRP to 256 accounts, about 184 times the fixed 100 billion supply.
  • The fix bypassed the amendment process, the first transaction-processing change in more than ten years to do so, because Ripple's report said the bug would otherwise stay exposed for weeks.
  • ZachXBT cited Zcash's $1.5 million award to researcher Taylor Hornby, a $750,000 bounty plus a matching $750,000 grant approved by coinholders, for a flaw that put about $2.3 billion of ZEC at risk.

Why it matters

  • decision The foundation has to choose between publishing a higher ceiling and relying on the side agreements with bounty hunters Vet described, and it did not disclose any added reward in this case.
  • exposure XRPNotCreated, the check meant to block coin creation, had a similar bug and missed the imbalance, so a finder's decision to disclose was what stood between holders and the mint.
  • precedent A later critical bug can cite the same amendment exception, and the speed came with a delayed source release that drew criticism from Cyber Capital's Justin Bons.
  • contradiction The two reports disagree on who wrote the cheque, Ripple or the foundation, and that decides who has to raise the cap.

The payout was thin, or rather the ceiling was: $250,000 is the most the program offers [2]. Veria estimated the amount at risk at nearly the token's entire $94 billion market value, at a price of $1.59 [12], so the payment is about 0.0003% of it [22]. Even the seven-figure floor ZachXBT asked for [1] would come to about 0.001% [23]. The $94 billion is Veria's own estimate.

Zcash is the benchmark ZachXBT chose [14]. Its base bounty to Hornby was $750,000, three times the XRP Ledger ceiling [24]. Shielded Labs executive director Jason McGee put that base at about 0.033% of the funds at risk, against a lowest precedent of 0.24% [15], so Zcash's starting point was already more than 120 times Veria's share [25]. McGee wrote that a higher reward was "cheap insurance" for the protocol [16].

We think the percentage frame overstates the case, because an attacker would realise less than the full market value. ZachXBT's own figure is smaller. "Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith," he said [10]. At the bottom of nine figures, $100 million, $250,000 is 0.25% [26], just above the 0.24% McGee called the lowest precedent [15], and every dollar over $100 million pushes it lower. On that basis the payout sits at the edge of precedent. On Veria's basis its share is less than one-hundredth of Zcash's [25].

The attack path has friction by Ripple's own account. Cryptopolitan reported that developers found no sign the bug was ever used, and that Ripple's report said an attack needed hundreds of offers priced in ways no real trader would use [5]. Against that, Veria's find came from an AI agent and Hornby's was also AI-assisted [c4, c15], and if an agent can find such a flaw for a researcher we'd expect it can for an attacker.

Bitcoin.com reported that Vet, a contributor to the XRP Ledger Foundation, agreed with ZachXBT [18]. "We have to make sure the incentive structure stays attractive with the value at risk. At the end we want to support white hats, that's much better than dealing with Lazarus," Vet said [19].

The fix route is the other half. The amendment process needs more than 80% of trusted validators to support a change for two weeks straight [7]; the gap from report to release was three days [21], and over 80% of validators on the default Unique Node List were running the patch by release day [9].

In our view the cap is low on either basis, and the claim that it pushes finders toward exploitation is plausible; neither report cites a finder who exploited instead of disclosing. If finders keep disclosing at $250,000 the claim weakens further, though only disclosed bugs are visible.

What to watch

  • A published change to the XRPL bounty ceiling, or terms for the commercial agreements Vet described.
  • Whether the next critical ledger fix goes through the amendment vote or ships as a server upgrade again.
  • Any report of a finder exploiting an XRPL flaw instead of disclosing it.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence58
Adoption
Insufficient
Hype gap+30
Incentives60
Confidence60
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    ZachXBT criticized the $250,000 awarded to Veria Labs in an October 12 post on X, writing that the finding 'should be a 7 fig pay day at minimum'.

    ReportedSupportedSource: Cryptopolitan, quoting ZachXBT's post on X2 sources— create a free account to open themView cited source
  2. [2]

    Veria co-founder Cayden Liao said Ripple paid the program's maximum $250,000 bounty; Bitcoin.com also describes $250K as the maximum offered by the bounty program.

    ReportedSupportedSource: Liao, per Cryptopolitan; Bitcoin.com2 sources— create a free account to open themView cited source
  3. [3]

    Veria Labs found a critical integer overflow in the XRP Ledger's payment engine that could have minted about 18.45 trillion XRP.

    ReportedSupportedSource: Cryptopolitan2 sources— create a free account to open themView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. cryptopolitan.com

    1 article · October 12, 2026

    ZachXBT calls $250K XRP Ledger bug bounty too low for 18-trillion flaw
  2. news.bitcoin.com

    1 article · October 12, 2026

    Sleuth ZachXBT Blasts Ripple’s Cheap $250K Payout for 18T XRP Bug

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Loading related stories