ZachXBT Slams Ripple’s 18T XRP Bug Payout

Sleuth ZachXBT Blasts Ripple’s $250K Payout for Bug That Could Mint 18 Trillion XRP

On-chain investigator ZachXBT has renewed criticism of Ripple after calling a $250,000 bug bounty payout “cheap” for a vulnerability that could have allowed a catastrophic supply event on the XRP Ledger.

The criticism centers on a bug disclosed by security researchers Cayden Liao and Veria Labs. According to the details shared, the flaw could have enabled an attacker to issue 18 trillion XRP in a single transaction—an amount described as 184 times the original capped supply.

ZachXBT’s comments landed as Ripple faces fresh scrutiny over insider selling and token distribution, reintroducing long-running debates about centralization risk around XRP.

Key context: XRP launched in 2012 with 100 billion tokens created. Of that supply, 80 billion were allocated to Ripple Labs and 20 billion to the project’s founders, a structure that has repeatedly drawn criticism from parts of the crypto community.

The timing also overlaps with renewed focus on Ripple co-founder Chris Larsen’s XRP holdings and sales. Larsen still reportedly controls between 2.58 billion and 2.81 billion XRP across multiple wallets. He has also reportedly sold 107 million XRP—valued at roughly $3.3 billion—since November 2024, adding fuel to concerns about supply dynamics and insider liquidation.

• ZachXBT’s core allegation: XRP holders act as “exit liquidity” for insiders.
• Trigger for renewed debate: a high-impact “infinite supply” style bug and the bounty amount paid for its discovery.
• Broader tension: ongoing questions around founder holdings and large-scale sales.

ZachXBT’s stance has also shown up in his interactions with XRP users. When one XRP holder asked for help tracking $33,000 in stolen XRP, he refused, citing an unwillingness to support what he characterized as Ripple’s “MLM-like structure.”

Separately, Ripple and ZachXBT have intersected in past security incidents. ZachXBT previously identified suspicious movements involving 213 million XRP after Larsen said more than $112 million worth of cryptocurrency was stolen from him, with funds moving through exchanges including Binance and Kraken. Ripple executives stated at the time that no Ripple-managed wallets were compromised, and that the incident was isolated to Larsen’s accounts.

While the bug disclosure highlights the importance of security research and responsible reporting, the dispute over the $250,000 payout—and the renewed attention on founder selling—underscores the larger governance and distribution questions that have followed XRP since inception.