XRP Ledger Fund Faces Heavy Criticism for Vulnerability Reward Payment

The XRP Ledger Foundation faced sharp criticism from the crypto community over the reward for discovering a critical vulnerability. Many users believe that $250,000 is too little for the problem found. According to the foundation's report, the vulnerability allowed an attacker to create spendable XRP beyond the total supply.

The fix, version 3.4.1, was released a few weeks ago, with public binaries published on September 25. The foundation states that no XRP was created and reminds that the XRP supply was fixed at 100 billion at launch, and all ledger data is public. Today, there are about 99.986 billion XRP, as transaction fees are destroyed. The foundation also notes that triggering the vulnerability required hundreds of deliberately crafted operations, so regular payments would not encounter it.

Critics argue not about the supply but about the size of the payout. One called the reward an "absolute joke" and warned that next time hackers might exploit the vulnerability first and then ask for a reward. Another stated that the team deserves a larger reward as the vulnerability was catastrophic. A third said the foundation should pay well to those finding bugs, or future hackers might choose a cheaper option. The harshest remark: XRP is a scam if a decent reward is not paid, and the next vulnerability might be disclosed irresponsibly.

Changes in the ledger usually go through an amendment process where validators vote for weeks. This time, the team skipped this stage and released an emergency fix — the first time in over ten years. The foundation explains: a public fix would have shown attackers where the vulnerability was, and AI accelerates its search. According to the foundation, the network, RippleX, key developers, and validators agreed on the plan together. Some users questioned the decentralization claims. One mentioned that a company he knew struggled to get help to change a name in the ledger. Another asked why there is no protection if the supply exceeds the limit. The foundation thanked Kaiden Liao and Veria AI for responsibly reporting the vulnerability and promised to enhance testing and expand the reward program.