AI Uncovers Biggest Hack $94 Billion XRP Ledger at Risk

An autonomous ai security agent by Veria Labs has uncovered what could have been the largest exploit in cryptocurrency history. The AI identified a critical vulnerability in the core source code of the XRP Ledger (XRPL) that would have allowed a malicious actor to mint 18.45 trillion XRP out of thin air—representing more than $94 billion in value at current market caps.

Unlike conventional hacks involving stolen private keys or compromised exchange backends, this flaw sat hidden inside the blockchain’s core mathematical logic for nearly a decade.

How the Vulnerability Worked: Chaining Two Decade-Old Overflows

The bug required the precise chaining of two independent integer overflow vulnerabilities originally written into the codebase in November 2015 and February 2017.

[256 Specially Crafted DEX Offers]
│
▼
[Overflow 1: BookStep Aggregation] ──► Integer Wrap Down to 256 Drops
│
▼
[Overflow 2: XRPNotCreated Invariant] ──► Integer Wrap Folds Net Gain to Match Fee
│
▼
[18.45 Trillion XRP Minted & Committed to Ledger in a Single Transaction]

1. Overflow 1 (BookStep Integer Overflow): When cross-currency payments are processed on the XRPL decentralized exchange (DEX), individual order-book conversions are handled by `BookStep`. Veria’s AI discovered that summing up native XRP amounts across multiple offers utilized a signed 64-bit integer without overflow protection. By carefully choosing 256 offers, an attacker could force the accumulated sum to wrap around to a small number (256 drops) while individual maker accounts still received their full payouts.

2. Overflow 2 (XRPNotCreated Invariant Bypass): Normally, XRPL runs an invariant check (`XRPNotCreated`) before committing any ledger state to ensure that native XRP isn’t created from nowhere. However, the invariant’s running total also used a signed 64-bit integer. Because the massive influx of minted XRP wrapped around in the exact same manner, the invariant check overflowed right back down to look like a standard transaction fee burn—allowing the invalid ledger state to pass verification.

3. The Yield: A successful exploit transaction would have injected 18.45 trillion XRP—184 times the total 100 billion fixed supply—evenly distributed across 256 accounts to bypass individual account holding limits.

Emergency Response: Skipping the Amendment Process

Upon receiving the vulnerability report on September 22, 2026, the development and validator community moved with unprecedented speed:

• Rapid Triage & Fix: The bug was confirmed on September 22, the fix was merged on September 23, and rippled v3.4.1 was released on September 25 with over 80% of validators upgraded almost immediately.
• Bypassing Tradition: For the first time in the ten-year history of the XRPL, validators skipped the standard multi-week voting amendment process. Going through public voting would have left the critical vulnerability exposed and exploitable on the mainnet for weeks.
• No In-The-Wild Exploitation: RippleX confirmed that forensics found zero evidence of the bug ever being exploited maliciously prior to disclosure.

The AI Security Turning Point

Veria Labs received the maximum $250,000 bounty for the discovery, setting a benchmark for AI-driven security research.

The incident underscores a shifting reality for enterprise security: while threat actors are increasingly deploying automated AI models to discover zero-days and logic flaws in legacy codebases, proactive defense frameworks are proving equally capable of finding and patching critical flaws before malicious actors can weaponize them.