Ripple has confirmed it patched a vulnerability dating back to 2015-2017 that could have enabled the creation of unlimited XRP tokens. The bug was discovered by Veria Labs, an AI firm, which found that a single transaction could mint 18 trillion XRP—nearly 184 times the current total supply.
Veria Labs reported the vulnerability on September 22, with Ripple shipping a fix three days later on September 25. Public disclosure followed on October 9. At the time of discovery in late September, XRP's market capitalization stood at approximately $94 billion, meaning the full amount was theoretically at risk.
Rather than follow the standard amendment vote process, Ripple developers coordinated an emergency upgrade with validators to minimize the exploitation window. Ayo Akinyele, head of engineering at RippleX, characterized the situation as serious, noting that AI is accelerating the pace at which vulnerabilities are discovered.
Cayden Liao of Veria Labs acknowledged that AI capabilities present a dual-edged challenge for security. While AI tools make older bugs cheaper to find for defenders, attackers have access to the same technology. Liao argued that defenders who adopt these tools as quickly as attackers do maintain an advantage, particularly given that there are more ethical security researchers than malicious actors.
The discovery underscores broader trends in cryptocurrency security. TRM Labs reported that AI-enabled scam activity increased roughly 500 percent over the previous year, while Chainalysis estimated total crypto scam losses at $17 billion for 2025.
Ripple indicated it plans to conduct comprehensive reviews of critical aspects of its ecosystem, including payments and peer-to-peer networking, to identify any additional vulnerabilities.
