ZachXBT says XRPL's $250K bug bounty risks nine-figure loss

According to crypto investigator ZachXBT, the XRP Ledger Foundation (XRPL) might face losses exceeding $100 million in a future hack, given that it only rewarded a whitehat hacker with $250,000 for discovering and disclosing an infinite XRP supply vulnerability.

In a post on X, ZachXBT claimed XRPL “cheaply” paid the hacker, pointing out that the company has “billions” in its treasury.

ZachXBT argued that the meager bounty might encourage future attackers to exploit large bugs instead of responsibly disclosing them.

According to him, such a scenario could cost XRPL “nine figures.”

“This is why people do not take XRPL or Ripple seriously as an org,” he added.

In comparison, a whitehat who could have minted unlimited Ether in 2022 received a $2 million bug bounty for reporting the exploit.

Infinite XRP bug caused underpayments to buyers

The XRP Ledger Foundation published a report last week detailing the vulnerability, which permitted the generation of new XRP from nothing.

Whitehat researchers Cayden Liao and Veria AI found the exploit and submitted it to XRPL on September 22 via its bug bounty program.

They identified an “integer overflow in the payment engine” that could be exploited through multiple XRP orders to result in underpayment.

XRPL said, “The engine paid each offer owner their full amount individually but charged the buyer only the wrapped-around total. The difference was new XRP that should never have existed.”

The foundation deployed a fix by September 25 and stated that there was “no evidence that this issue was exploited on any public network.” It also noted the vulnerability had existed since 2015.

Since its 2012 launch, 100 billion XRP have been in circulation, giving the token a current market capitalization of $86.5 billion.

The design of XRP was intended to stop any further XRP from being minted.

Bug bounties at Tether and Circle also criticized as 'inadequate'

In 2025, DeFi risk management firm Llamarisk had criticized Tether and Circle's bug bounties, noting they did not surpass $10,000.

Llamarisk called those amounts “inadequate” and said at least $50,000 is needed to attract skilled security researchers.

LlamaRisk claims, “For protocols with total value locked (TVL) above $250 million, a maximum payout exceeding $1 million represents a sufficiently capitalized program.”

Currently, XRP's total value locked stands at $41.8 million.