An AI agent just found a way to print XRP out of thin air. Luckily, it belonged to the good guys.
The XRP infinite mint bug was a flaw in the XRP Ledger’s payment engine. It let an attacker create about 18.4 trillion XRP in a single transaction. Security firm Veria Labs reported it on September 22, 2026. Three days later, the fix was live, and nobody had exploited it.
So is your XRP safe? Yes. Below, I explain what happened in plain English.
What Is the XRP Infinite Mint Bug?
XRP launched with a fixed supply of 100 billion coins. Nobody can mine or stake new ones. In fact, every transaction burns a small fee, so the supply should only shrink. New to the coin? Then start with what XRP is and how the XRP Ledger works.
This bug broke that rule. According to Veria Labs, one transaction could create 18.4 trillion XRP. That is 184 times the entire supply. Moreover, an attacker could repeat it.
It was also cheap. The XRP Ledger team says the real cost was a few hundred XRP in reserves, plus normal fees. In addition, the attacker needed no special access.
The official disclosure report came out on October 9. One day later, Veria published its own write-up with the full story.
How Two Small Bugs Became One Big One
The trick chains two flaws together. Each one looks harmless alone.
First, some background. The XRP Ledger has a built-in exchange. A single payment can buy through many sell offers at once. To do that, the software adds up what the buyer owes.
Here is the first flaw. That sum had a maximum size. When the total went past it, the number didn’t fail. Instead, it wrapped around to a tiny value, like an old car odometer rolling back to zero.
As a result, each seller received the full amount. Meanwhile, the buyer paid almost nothing. The difference was brand-new XRP.
Normally, a safety check catches this. After every transaction, the ledger confirms that no XRP appeared from nowhere. However, that check added numbers the same way. Therefore, it wrapped around too and saw nothing wrong.
A second check caps any single account at 100 billion XRP. So the exploit simply spread the coins across 256 accounts.
The code behind both flaws dates from 2015 and 2017. Because no normal payment gets near those numbers, nobody noticed for about a decade. I first bought XRP in 2015, the same year part of this code went live. That thought is a little wild.
How the AI Found It
Veria Labs builds AI agents that hunt for security holes. On September 21, the team pointed its agent at the XRP Ledger software.
The agent found both flaws. Then it worked out how to combine them. Finally, it built a working exploit on a private test network.
Cayden Liao of Veria Labs says the alert came in late on a Monday night. At first, he didn’t believe it. So he read the proof three times and woke up a colleague at 4 am. By morning, they were sure.
Here is the part that stands out to me. The XRP Ledger is one of the most reviewed codebases in crypto. Veria counts more than a dozen audits and audit contests since 2024 alone. Still, an AI caught what all of them missed.
Afterwards, Veria tested general-purpose coding agents on the same code. According to the firm, they couldn’t find the bug.
For the find, Veria says it received the maximum bounty of $250,000.
Fixed in Three Days
The response was fast.
- September 22: Veria reports the bug. RippleX engineers reproduce it and rate it critical.
- One day later, engineers merge the fix.
- By September 25, version 3.4.1 ships. More than 80% of the main validators upgrade that same day.
Normally, rule changes on the XRP Ledger need a validator vote. That process takes weeks. This time, the team skipped it. It was the first deliberate skip since the voting system began more than ten years ago.
Why? The software is open source. Consequently, a public fix also shows attackers where the hole is. Waiting weeks for a vote would have left the door open.
Is Your XRP Safe?
Yes. The XRP Ledger team found no evidence of an exploit on any public network. So there is no sign of fake XRP in circulation.
As a holder, you don’t need to do anything. You don’t need to move coins, update a wallet, or claim anything. Only people who run XRP Ledger servers had to upgrade.
However, watch out for scammers. News like this is perfect bait. Expect fake “XRP migration” sites and fake compensation claims. We saw the same playbook in the Claude trading bot scam, where an AI name was the hook. Remember, a real fix never asks for your seed phrase.
Thinking about a first purchase now? Then our guide on how to buy XRP for the first time walks you through it.
About That $94 Billion Number
Veria says the bug put $94 billion at risk. That was XRP’s full market value at the time, at $1.59 per coin. The firm also calls it more than 60 times the Bybit hack, which cost $1.5 billion.
That framing deserves a footnote, though. Nobody could have sold trillions of fake XRP at market price. Even Veria admits that in its write-up. Instead, the real danger was a collapse in trust. If the supply cap breaks, the price follows.
So the headline number is partly marketing. The bug itself, however, was very real. RippleX engineers rated it critical.
AI Cuts Both Ways
This is the second infinite mint bug this year that AI helped find. In June, a researcher using AI tools caught the ZEC exploit in Zcash’s Orchard pool. That one had been live for four years.
There is one big difference, though. Zcash couldn’t fully prove that nobody used its bug, because its transactions are private. On the XRP Ledger, balances are public. Therefore, trillions of new coins would have stood out.
Attackers have the same tools, of course. Veria points to this summer’s Coldcard drain as an example. In that case, Coinkite suspects AI helped find an old firmware bug.
Meanwhile, some researchers fear AI could break wallet math itself. I covered that debate in my crypto bunker mode post. This XRP story is different, because the AI found a bug in code, not in math.
Still, plenty of losses start with ordinary choices. For example, the CryptoBilis reseller case began with where people bought their hardware wallets.
Keep This Content Free
Bug explainers like this one take hours to check against the source reports. Want to support them? Then sign up through our referral links:
Final Words
The XRP infinite mint bug sat in the code for about a decade. An AI agent found it in a day. Three days after the report, the team had closed the hole.
For holders, nothing changes. For the industry, plenty does. Old code is no longer safe just because it is old. So expect more stories like this one, and hope the good guys keep finding them first.
FAQ
What is the XRP infinite mint bug?
It was a flaw in the XRP Ledger’s payment engine. A single crafted payment could create XRP from nothing. The team fixed it in version 3.4.1.
Was the XRP bug exploited?
No. The XRP Ledger team found no evidence of an exploit on any public network.
Do I need to move my XRP?
No. Holders don’t need to do anything. Only server operators had to upgrade their software.
Who found the bug?
An AI agent from Veria Labs found it. Cayden Liao then reported it through the XRPL bug bounty program on September 22, 2026.
How much XRP could an attacker create?
About 18.4 trillion XRP per transaction, according to Veria Labs. That is 184 times the total supply, and the attack was repeatable.
How long did the fix take?
Three days. The report came in on September 22, and version 3.4.1 shipped on September 25.
Credit: Source link
