An AI Agent Just Found a Bug That Could Have Minted $29 Trillion in Fake XRP

MakeCryippreferred on

• Veria Labs published a blog post on October 10, 2026 revealing that its AI security agent found and chained two integer-overflow bugs in the XRP Ledger’s rippled software, present in code since 2015 and 2017
• Exploiting the chained bugs could have let an attacker mint roughly 18.45 trillion XRP in a single transaction, about 184 times the entire 100 billion token supply and worth an estimated $29 trillion at the time
• Veria reported the bug through XRPL’s bug bounty program on September 22, 2026, and received the program’s maximum $250,000 payout, with RippleX finding no evidence the bug was ever exploited on mainnet

Veria Labs disclosed on October 10, 2026 that an AI coding and security agent it built had uncovered what the firm calls the largest vulnerability ever found by an AI acting alone in the cryptocurrency industry, a flaw in the XRP Ledger that could have allowed an attacker to mint an almost incomprehensible amount of fake XRP out of thin air. The post, titled “The Biggest Hack in Crypto History That Never Happened,” walks through how the bug was found, how it worked, and why it went unnoticed in the XRPL codebase for roughly a decade.

The underlying flaw combined two separate integer-overflow bugs that were each harmless on their own but became dangerous once chained together. The first sat in the BookStep code responsible for handling conversions on the XRP Ledger’s built-in decentralized exchange, allowing a payment to charge almost nothing while crediting the recipient with trillions of units. The second was in the XRPNotCreated invariant, a safeguard specifically designed to catch newly created XRP that shouldn’t exist, which wrapped its internal accumulator in a way that made the freshly minted tokens appear to the system like an ordinary transaction fee being burned rather than new supply being created.

According to Veria, chaining the two bugs together would have let an attacker mint approximately 18.45 trillion XRP in a single crafted transaction, a figure roughly 184 times larger than XRP’s entire 100 billion token supply. At the token’s price around the time of discovery, the firm estimated the notional value of that fabricated supply at close to $29 trillion, a figure the post says dwarfs the previous record for a bug found by a security researcher, a 2021 issue on Polygon that put an estimated $24 billion at risk.

Veria’s team said its AI agent independently identified both overflow bugs, worked out that they could be combined, and built a working proof of concept that confirmed the exploit path was reachable on a live network configuration. The bug was reported through the XRP Ledger Foundation’s bug bounty program on September 22, 2026, and confirmed by the foundation the same day. A fix was merged just one day later on September 23, and the emergency release, rippled version 3.4.1, shipped on September 25, with XRPL skipping its usual multi-week amendment voting process for the first time to get the patch into validators’ hands as quickly as possible. RippleX later confirmed it found no evidence that the vulnerability had actually been exploited before the fix went out.

Veria received the bug bounty program’s maximum payout of $250,000 for the find, which the firm describes as the largest reward ever paid for a vulnerability discovered entirely by an AI agent. The post, published on Veria Labs’ own blog, argues that the episode cuts both ways for the industry: the same AI tools that let defenders uncover decade-old bugs hiding in plain sight can just as easily be pointed at the same codebases by attackers, meaning the side that adopts these tools fastest is likely to hold the advantage going forward.