Crypto sleuth ZachXBT says the XRP Ledger Foundation (XRPL) can potentially look forward to losing upwards of $100 million next time it’s hacked after the company paid a whitehat hacker just $250,000 for uncovering and reporting an infinte supply XRP bug.
ZachXBT claimed XRPL “cheaply” paid the hacker, noting the crypto firm has “billions” in its treasury.
He suggested that XRPL’s stingy reward could lead to cybercriminals in the future choosing to exploit similar major vulnerabilities rather than reporting them in good faith.
This, he says, could cost XRPL “nine figures.”
“This is why people do not take XRPL or Ripple seriously as an org,” he added.
By contrast, in 2022, an Ethereum hacker who could’ve printed an infinite supply of ETH was paid a $2 million bug bounty for disclosing the potential exploit.
Infinite XRP hack charged buyers less than intended
XRPL released a report last week that disclosed the flaw allowing the creation of new XRP tokens out of thin air.
This exploit was discovered by whitehat hackers Cayden Liao and Veria AI, and submitted to XRPL’s bug bounty program on September 22.
The pair found that an “integer overflow in the payment engine” could be manipulated with various XRP orders to underpay funds.
XRPL said, “The engine paid each offer owner their full amount individually but charged the buyer only the wrapped-around total. The difference was new XRP that should never have existed.”
Read more: The year’s second-largest XRP hack is spilling over to Bitcoin and Ethereum
XRPL submitted a fix by September 25, claiming there’s “no evidence that this issue was exploited on any public network.” It added that the bug has been around since 2015.
There are 100 billion XRP in circulation from XRP’s 2012 launch, which now has a market cap of $86.5 billion.
XRP was built to prevent any more XRP from being created.
Tether and Circle bug bounties also ‘inadequate’
DeFi risk management firm Llamarisk has previously criticised bug bounties offered by Tether and Circle in 2025, finding that they failed to exceed $10,000.
They claimed these numbers were “inadequate,” and that a minimum of $50,000 is required to attract decent security researchers.
LlamaRisk claims, “For protocols with total value locked (TVL) above $250 million, a maximum payout exceeding $1 million represents a sufficiently capitalized program.”
XRP’s TVL is currently $41.8 million.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
