Overview
- Veria Labs' AI agent reported the vulnerability on Sept. 22 and built a working exploit on a testnet, leading RippleX to release xrpld 3.4.1 on Sept. 25 and publish a full technical disclosure on Oct. 9.
- The bug was an integer overflow in the XRPL payment engine that could let carefully constructed trades wrap arithmetic so sellers were paid in full while a buyer was charged a tiny amount, which in theory could create about 18 trillion XRP but could not be triggered by normal payments.
- XRPL operators and the Foundation say investigators found no evidence the flaw was used on public networks and public ledger data shows about 99.986 billion XRP remain in circulation, a figure anyone can verify via explorers.
- Developers coordinated an emergency upgrade that bypassed the usual two-week amendment vote, distributed patched binaries first to limit exploit risk, and required nodes to run 3.4.1 or newer to stay in consensus.
- The incident earned Veria a $250,000 top bounty and has prompted plans to expand AI adversarial testing, require retesting of fixed findings against release candidates, and accelerate formal verification of legacy code paths.