Blockchain investigator ZachXBT has criticized the $250,000 reward paid to the researchers who uncovered a critical vulnerability in the XRP Ledger, arguing that the payout was disproportionately small relative to the potential damage the flaw could have caused.

In an October 12 post on X, ZachXBT questioned why a researcher who responsibly disclosed a vulnerability capable of creating XRP beyond its intended supply received only a quarter of a million dollars.

"Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?" he wrote.

He warned that inadequate compensation could discourage future disclosures and potentially push malicious actors to exploit vulnerabilities instead of reporting them. ZachXBT also questioned the credibility of Ripple and the broader XRP Ledger ecosystem regarding their approach to security incentives. Reward sizing is a recurring point of debate in software security, where bounty ceilings are typically fixed in advance by the sponsoring organization while the potential cost of an unpatched flaw can be far larger.

$250K Was the Maximum Available Reward

The criticism followed a response from the XRP Ledger Foundation addressing the vulnerability and its emergency remediation.

Security researchers Cayden Liao and Veria AI discovered the flaw on September 21 and submitted it through the XRPL Bug Bounty program the following day. Veria Labs confirmed on October 8 that it had received $250,000, the maximum available under the program, and said an AI security agent had identified the vulnerability and generated a working proof of concept. Bug bounty programs of this kind are a standard industry mechanism for compensating responsible disclosure, with payout limits set by the program's sponsor.

The firm estimated that a single malicious transaction could have created approximately 18 trillion XRP — more than 180 times the cryptocurrency's original 100 billion supply. Veria Labs also described the payment as the largest bounty it was aware of for a vulnerability discovered entirely by an AI agent.

ZachXBT's criticism centers on the gap between the reward ceiling and the potential economic consequences of an attack. His warning concerns the incentives facing future researchers, rather than any allegation that the team behind this disclosure acted improperly.

XRP Ledger Bug Had Existed Since 2015

The disputed payout relates to a critical payment-engine vulnerability that had remained undetected for more than a decade. The flaw involved an integer overflow — a class of bug that occurs when a calculation exceeds the maximum value a numeric field can store — that be triggered when a specially constructed payment consumed hundreds of offers from the XRP Ledger's decentralized exchange.

An attacker could manipulate the calculation so that offer owners received their full XRP amounts while the paying account was charged only a small fraction of the total. A safeguard designed to prevent unauthorized XRP creation suffered from the same overflow problem.

The official vulnerability disclosure confirmed that RippleX engineers reproduced the exploit in a standalone testing environment and verified that the newly created XRP could subsequently be spent. No evidence of exploitation on a public XRP Ledger network was found.

Emergency Patch Deployed Within Three Days

RippleX released the corrective update in xrpld version 3.4.1 on September 25, three days after receiving the report. The emergency response bypassed the usual amendment voting process — through which validators typically vote on protocol changes — because developers considered leaving the vulnerability exposed substantially more dangerous than deploying an immediate consensus-sensitive fix.

More than 80% of validators on the default Unique Node List had upgraded by the release date, protecting the network against the supply-creation vulnerability.

The researchers received their reward nearly two weeks later, and the full technical disclosure became public on October 9. That sequence — private report, emergency patch, payment, then full public disclosure — follows the coordinated vulnerability disclosure model widely used in software security, which is intended to give network operators time to upgrade before exploit details are published. The $250,000 payment remains the confirmed maximum bounty awarded under the program for the discovery.