Key Takeaways
- ZachXBT slammed a $250K reward for a critical XRP bug that could have minted 18 trillion new tokens.
- An AI-found flaw threatening XRP’s supply cap was quickly patched before any tokens could be exploited.
- ZachXBT warned low rewards incentivize hacks, prompting the XRP Foundation to rethink its bounty sizes.
ZachXBT Criticizes ‘Cheap’ $250K Reward to XRP Infinite Supply Bug
Blockchain security and the value of critical bug bounties are being debated publicly, with the XRP Ledger Foundation at the center of it.
ZachXBT, the renowned and controversial blockchain sleuth who recently announced he had infiltrated a Chinese crypto money laundering group, has criticized how Ripple and the Ripple Ledger Foundation treated the white-hat researchers who disclosed a critical bug that, if exploited, could have caused a disaster for XRP’s market capitalization.
The bug, present in XRP’s codebase for over a decade, would have enabled an attacker to issue 18 trillion XRP out of thin air with a single transaction, 184 times the currency’s fixed total supply (100 billion tokens). The bug was reported and confirmed on September 22; a fix was coded and released on September 25, before over 80% of validators upgraded to the new version, rendering the exploit useless.
As a reward for his work on this bug, Caydel Liao, co-founder of Veria Labs, was awarded $250K, the maximum offered by the Ripple Team’s bug bounty program. On social media, Liao stated that he believed this was the largest ever paid out for a vulnerability discovered entirely by an AI agent.
Nonetheless, ZachXBT stated this amount was insufficient due to the severity and potential impact of the bug reported.
“Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions? Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith.” ZachXBT assessed, stressing that this contributed to fostering negative views towards Ripple as a serious organization.
Vet, a contributor to the XRP Ledger Foundation, agreed with ZachXBT’s POV, highlighting that they were strengthening the bug bounty program. He also disclosed that the foundation had reached commercial agreements with bug bounty hunters beyond the bounty program.
“We have to make sure the incentive structure stays attractive with the value at risk. At the end we want to support white hats, that’s much better than dealing with Lazarus,” he concluded, but he did not disclose additional rewards in this specific case.
In August, ZachXBT refused to offer tracing support to victims of the ColdCard exploit, explaining that his time was focused on ecosystems that valued his work.
