On-chain investigator ZachXBT criticized the XRP Ledger (XRPL) Foundation on October 12, 2026, over its $250,000 bug bounty paid to a white-hat hacker who discovered a critical vulnerability
On-chain investigator ZachXBT criticized the XRP Ledger (XRPL) Foundation on October 12, 2026, over its $250,000 bug bounty paid to a white-hat hacker who discovered a critical vulnerability in the network. The flaw could theoretically have allowed an attacker to bypass XRP’s maximum supply limit and create additional tokens beyond the permitted amount. The foundation confirmed that the vulnerability was patched in version 3.4.1 and that no additional XRP had been maliciously minted before the fix.
Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?
Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith.
This is why people do not take XRPL or Ripple seriously as an org….
— ZachXBT (@zachxbt) October 12, 2026
ZachXBT described the $250,000 reward as “peanuts,” arguing that the potential impact of the vulnerability warranted higher compensation. He warned that underpaying security researchers could discourage responsible vulnerability disclosures and create incentives for some to exploit critical flaws for financial gain instead.
The $250,000 bounty started a debate over whether responsible vulnerability disclosures offer enough financial incentive compared with exploiting security flaws. An X user @Wofuhuola argued that attackers who steal millions of dollars can sometimes negotiate to return the funds in exchange for a smaller reward and assurances against further action. By comparison, white-hat hackers who report vulnerabilities capable of causing hundreds of millions of dollars in losses may receive relatively modest compensation, potentially discouraging responsible disclosure.
在币圈，如果你发现了一个漏洞，直接把钱拿出来，放到eth链上，比如你拿到1000w美元，他们会和你洽谈，希望你能还回来，并愿意给你200w美元作为奖励，并承诺永不追究 事后他们还要谢谢你呢
但是如果你是一个白帽，你告诉了他们问题，即使你发现的问题可能会导致几亿美元的损失，他们还是不会感谢你，白帽奖金就像是打发要饭的
这就是现状，好人永远被枪指着
— 炒鸡飞行员 (@wofuhuola) October 12, 2026
However, another X user, @Moonkie, challenged the criticism by distinguishing between Ripple and the XRPL Foundation. According to Moonkie, Ripple has greater financial resources, while the foundation cannot afford comparable payouts. Moonkie also noted that the $250,000 reward followed the existing bug bounty programme’s rules, although those rules may need improvement to better reflect the severity of critical vulnerabilities.
Fair, but the one who paid the bounty and has the billions is Ripple, not the XRPL Foundation
The XRPL Foundation doesn’t have that kind of money
At the same time, the rules of the bounty program were followed – rules which should probably be improved
— moonkie
(@xmoonkie) October 12, 2026
Tim Is for Hire offered a different perspective, arguing that bounty size influences a researcher’s decision but is not the only consideration. Using an expected-utility framework, the commenter explained that the decision to report or exploit a vulnerability depends on potential profits, the risk of prosecution, the ability to launder stolen funds and ethical considerations.
This take isn’t very accurate. Bounty size does influence the decision, just not dramatically
A quick way to think about it is expected utility: a rational actor compares what each option is actually worth to them, not the headline number. Reporting pays the bounty (B), almost risk-free. Exploiting pays the full value (V) only on paper. In practice you have to discount it by the chance of getting caught, by how much of it you can actually turn into usable money and by what it costs you ethically
Take Lazarus: p ≈ 0 (no legal risk), λ ≈ 1 (laundering is their core skill), E ≈ 0. The left side is basically the full exploit value, so no bounty will ever compete with it
A whitehat has high E, a high chance of prosecution and weak laundering skills. Their expected profit from a real hack ends up below even a modest bounty
The utility function is illustrative. I’ve highlighted a few parameters, and the real decision is more complex
— Tim is for hire (@grass_the_touch) October 12, 2026
READ ALSO: XRP Ledger Validators Race to Upgrade Ahead of May 27 Amendment Activation
AI-powered security testing is changing how developers identify vulnerabilities in blockchain software. A March 2026 study introducing EVMbench, developed by OpenAI, Paradigm and OtterSec, evaluated AI agents against 117 vulnerabilities across 40 repositories. The benchmark tested whether agents could detect flaws, develop fixes and exploit weaknesses in controlled environments. Its findings showed that AI agents could discover and exploit vulnerabilities, suggesting that automated testing can complement conventional security audits.
However, identifying a vulnerability does not guarantee that an AI system can exploit it reliably or produce a safe fix. In a 2025 report, Anthropic reported that its Claude Opus 4.5, Sonnet 4.5, and GPT-5 models successfully generated exploits for 19 of 34 problems in a benchmark of previously exploited smart contracts. The research shows how the same technology can strengthen security testing while expanding attackers’ capabilities.
Enjoyed this? BookmarkDeFi Planet, explore related topics, and follow us onTwitter,LinkedIn,Facebook,Instagram,Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
The post ZachXBT Criticizes XRPL Foundation Over $250K Bug Bounty appeared first on DeFi Planet.
