Ripple Bug Bounty Controversy — XRPL $250K Payout Criticized (October 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·52AJ8K…3dQYSummary
In September–October 2026, Veria Labs disclosed a decade-old critical integer-overflow vulnerability in the XRP Ledger that could theoretically have minted approximately 18.45 trillion XRP — roughly 184 times the network's fixed 100 billion supply cap — in a single transaction. Ripple paid Veria Labs the maximum allowable bounty under its program, $250,000, and patched the flaw within three days of disclosure. On-chain investigator ZachXBT and multiple researchers publicly criticized the payout as severely inadequate relative to the severity of the vulnerability, the scale of assets at risk, and industry benchmarks from comparable protocols, arguing the structure systematically underincentivizes white-hat disclosure.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(12 events)
1 November 2015
First integer-overflow vulnerability introduced into XRP Ledger BookStep aggregation code (approximate date based on codebase history).
Veria Labs blog1 February 2017
Second integer-overflow vulnerability introduced into XRPNotCreated supply-preservation invariant (approximate date based on codebase history).
Veria Labs blog21 September 2026
Veria Labs' AI security agent autonomously identifies both vulnerabilities in rippled source code and chains them into a working exploit on a local test network.
Veria Labs blog22 September 2026
Veria Labs submits working proof-of-concept to the XRP Ledger bug bounty program. Submission confirmed same day by RippleX.
Veria Labs blog25 September 2026
rippled v3.4.1 released with the patch, bypassing the standard amendment process. Approximately 80% of validators upgraded within hours.
Veria Labs blog / Forklog28 September 2026
XRPN shareholder redemption window closes. Shareholders had not been informed of the critical vulnerability or its patch.
Protos30 September 2026
XRPN shareholder vote passes, approving the Evernorth Holdings merger and its path toward a Nasdaq listing.
Protos / CoinGape8 October 2026
Ripple awards Veria Labs the maximum $250,000 bounty for the vulnerability.
Veria Labs blog9 October 2026
RippleX publishes official public vulnerability disclosure report. Evernorth merger closes same day.
Protos / Bitcoin.com News12 October 2026
ZachXBT publicly criticizes the $250,000 bounty payout, stating it 'should be a 7 fig pay day at minimum,' and warns the structure may discourage future responsible disclosure.
CryptoTimes / Cryptopolitan13 October 2026
No public response from Ripple or the XRPL Foundation to ZachXBT's bounty criticism. No increase to the maximum bounty ceiling announced.
CryptoTimes / CryptopolitanDecision Log
- slot 456620304 · hash 7NGhDchuy33vqRfZsDUGPmXv1coLjDTSwCkAQJWw5Sy1
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 14 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/13/2026, 11:17:41 PM
last updated: 10/13/2026, 11:17:41 PM
avoid.net — verified advice for a post-truth world