This content is for informational and educational purposes only and does not constitute financial advice. Always do your own research. Not financial advice (NFA).
This Week
XRP had a rough week. It ends Sunday around $1.41, down 5.8%, after a range between $1.53 and $1.31. The low came on Thursday, when bitcoin funds were selling hard and the whole market slid. Crypto as a whole fell 3.4% to $2.88 trillion. Bitcoin now holds 58.5% of it. And the Fear and Greed Index? It reads 61. Still Greed.
Then on Friday came the biggest news the XRP Ledger has ever had to share. For 10 years its code carried a bug that could have created XRP out of nothing, far beyond the 100 billion that will ever exist. An AI found it. Ripple’s engineers fixed it in secret. It leads the stories below.
Evernorth closed its deal on Friday, and XRPN starts trading on Nasdaq under its own name on Monday. The filing finally shows who owns it and what a share holds. The XRP funds took money in again while bitcoin’s funds bled. And Batch, the upgrade that bundles transactions into one, went live on the ledger.
The Consensus
🐛 The XRP Ledger bug could have created about 18 trillion XRP, and was fixed in secret before anyone used it.
🏦 Evernorth’s closing filing shows who owns XRPN and what a share holds, before its Nasdaq start on Monday.
💰 The XRP funds took money in for a 13th straight week, while bitcoin, ether and Solana funds lost money.
🔗 Batch went live on the XRP Ledger, letting up to 8 transactions settle as one.
The Numbers
The Chart Watch
The Ripple Effect
🐛 18 Trillion XRP From Thin Air: The Bug That Could Have Broken XRP
For 10 years a flaw sat inside the XRP Ledger that let anyone print XRP out of nothing. About 18 trillion XRP, in a single payment. That is 184 times every XRP in existence. An AI found it last month. Ripple’s engineers fixed it in 3 days, kept it secret for 2 weeks, and told the world on Friday. Here is the full story, and why the biggest names at Ripple have gone silent.
Late on a Monday night
On Monday 21 September a small security firm, Veria Labs, pointed its AI agent at the XRP Ledger’s code. Late that night, the agent flagged something.
Founder Cayden Liao read it 3 times and didn’t believe it. By the small hours he still couldn’t find a flaw in it, so he woke up his founding engineer. By morning they were sure. The AI had found a way to create brand new XRP, and built a working attack to prove it (Veria Labs).
The bug had been in the code since 2015. Ripple’s engineers rebuilt the attack the next day. It worked. The fake XRP could be spent like any other XRP (XRP Ledger disclosure report).
How do you print 18 trillion XRP?
The XRP Ledger has a built-in exchange. One payment can buy from hundreds of sellers at once, and the software adds up the bill.
That bill had a ceiling. Think of an old car odometer. Drive past 999,999 miles and it rolls back to zero. Push the bill past the ledger’s ceiling and it rolled back to almost nothing.
Set up hundreds of accounts. Have each one sell a sliver of a token for an enormous amount of XRP. Then buy the lot in one payment. The sellers get paid in full. The buyer gets charged almost nothing. The difference is XRP that never existed.
The ledger has an alarm for exactly this. After every transaction it checks that no new XRP has appeared. The alarm used the same maths, so it rolled over too and stayed silent.
The cost of the whole attack? A few hundred XRP, most of it refundable.
Could this have sent XRP to zero?
Zero? Probably not. Nobody could ever sell 18 trillion XRP, because there are not enough buyers on the planet.
An attacker never needed to sell it all. Here is how it could have played out. Open big bets against XRP first. Mint a few billion fake XRP. Dump them on every exchange that will take them. The price collapses, the bets pay out, and the attacker gets paid twice.
Then the news breaks that XRP’s fixed supply, the one promise it makes to every holder, is gone. Nobody can tell real XRP from fake. Nobody knows how much more is out there.
We know how markets react. In June, Zcash disclosed almost the same kind of flaw: unlimited fake coins found with AI and fixed before anyone used it. ZEC still crashed 38% in a day (CoinDesk). That was for a bug nobody exploited.
My read: a real attack on XRP means a 90% crash, easily.
Fixed in 3 days. Secret for 14.
The fix was written the next day and shipped on Friday 25 September.
Then they did something the XRP Ledger had never done. Any change to how transactions work needs over 80% of the main validators to vote yes for 2 weeks. That would have left the bug sitting in public code for 2 weeks, readable by anyone. So they skipped the vote. The fix went out as a sealed download with the code hidden, and validators were asked to install it immediately. More than 80% did on day one.
What was the public told? A “Batch fix and stability improvements.”
For 14 days the most dangerous bug ever found in the XRP Ledger was fixed, and almost nobody knew. On 8 October Justin Bons of Cyber Capital spotted the hidden code and called selling XRP as decentralised “straight-up fraud”.
The next day the real reason came out.
RippleX engineer Mayukha Vadari explained the secrecy in one line: “Things have changed with AI. You can’t just sneak in a critical bug patch in a regular public release process.”
$250,000 to save $94 billion
Veria says it was paid $250,000, the most the XRP Ledger bug bounty pays out (Veria Labs).
$94 billion of XRP was on the line. That is $1 of reward for every $376,000 protected.
Others have paid far more. Polygon paid $2.2 million in 2021 for a bug that put $24 billion at risk. Wormhole paid $10 million in 2022.
So why the cap? Ripple hasn’t said. The AI tools Veria used are available to anyone. The next person to find a bug like this has a choice: $250,000 for reporting it, or billions for using it. In my opinion the reward has to make the honest choice the easy one.
