An AI Agent Found a Bug Worth $94 Billion. The Humans Still Had to Understand It.

A decade-old integer overflow in the XRP Ledger could have minted 18 trillion XRP. The bounty was $250,000. Here's what that means for beginners.

I read the Veria Labs write-up on a Saturday morning and felt something I hadn't expected: vertigo.

An AI agent found a vulnerability in the XRP Ledger's payment engine. The bug had been sitting there since 2015 — eleven years — in one of the most audited codebases in crypto. A single successful exploit could have created approximately 18.45 trillion XRP in one transaction. That's about 184 times the total supply.

Cayden Liao, co-founder of Veria Labs, reported it through the XRPL bug bounty program on September 22, 2026. Ripple fixed it in three days. The payout: $250,000 — the program's maximum reward.

The AI found it. But Liao had to understand it before he could report it.

What the Bug Actually Was

The vulnerability was a 64-bit integer overflow in the XRP Ledger's payment engine. It triggered when trades executed across multiple bids in the order book — a specific, multi-step condition that required understanding how the payment engine handles calculations.

When the condition was met, the overflow allowed an attacker to credit themselves with XRP that didn't exist. Not stolen. Created.

Liao's technical write-up describes the exploit as requiring "specially crafted offers in the order book and a single payment." The Veria AI system identified the vulnerability, but Liao had to validate it — confirm it was real, understand why it worked, and demonstrate the impact clearly enough for Ripple's engineers to act.

The fix was deployed in xrpld 3.4.1 on September 25. No evidence of exploitation was found.

The Part That Should Change How You Think About AI

I've written before about AI flooding bug bounty programs with slop. Google paused its OSS VRP because automated submissions overwhelmed the team. curl ended its bounty program after confirmed vulnerabilities fell from 15% to below 5%.

Those stories are about AI making noise.

This story is about AI making signal. Real signal. A bug that eleven years of human auditors and automated scanners missed.

Veria Labs built an AI system specifically for this. It wasn't a general-purpose chatbot. It was a tool designed to find vulnerabilities in complex systems. And it found one that mattered — a bug that could have destroyed the XRP Ledger's entire monetary model.

But here's the part that matters for beginners: the AI didn't write the report. It didn't understand the impact. It didn't explain why a 64-bit overflow in a payment engine is catastrophic. It didn't prove the exploit was real.

Liao did that. The AI found the thread. The human pulled it.

Why This Terrifies Me (And Why It Shouldn't)

I'm a beginner. I've found one confirmed bug. I'm still learning how to read HTTP requests properly.

Reading about Veria AI's discovery, I felt two things at once.

First: fear. If an AI can find a decade-old bug in audited code, what chance does a human beginner have? The machines are finding things that humans missed for years. The bar just went up.

Second, and I didn't expect this: relief.

Because the Veria AI story doesn't say "AI replaced the researcher." It says AI changed what the researcher needs to be good at.

Liao didn't need to find the bug manually. The AI did that. Liao needed to understand it. He needed to validate it. He needed to explain it to Ripple's engineers in a way that got it fixed in three days.

That's the skill that matters now.

What I'm Doing Differently

I'm not going to pretend I can build a Veria AI. I can't. But I can change how I think about the tools I use.

First, I'm treating AI as a discovery tool, not a reporting tool. The AI finds things. I verify them. I understand them. I write the report. The AI doesn't hit submit. I do.

Second, I'm focusing on the part AI can't do. The AI found an integer overflow. But explaining why that matters — what it means for the XRP Ledger's monetary policy, what an attacker could actually do, what the business impact would be — that's the human job.

Third, I'm remembering that the best bugs are the ones that have been there the longest. A bug from 2015 that eleven years of auditors missed doesn't get found by running a scanner. It gets found by understanding how the system works — and asking the question nobody thought to ask.

The Uncomfortable Truth

Veria AI found a bug worth $94 billion in potential impact. The bounty was $250,000.

That's not a complaint about the payout. It's an observation about asymmetry. The value protected is almost always greater than the bounty paid. That's the entire point of bug bounty: pay a small amount to prevent a catastrophic loss.

But the asymmetry also tells me something about where the opportunities are. The bugs that matter most aren't always the ones with the biggest bounties. They're the ones that protect the most value. And those bugs are often in places nobody thinks to look.

I don't have an AI agent. I don't have a decade of experience. I don't have a $250,000 bounty.

But I know where the bugs are now. They're in the places everyone assumes are safe. They're in the code that's been audited so many times that nobody bothers to look again.

And they're waiting for someone to ask the right question.

If you're also learning to navigate a world where AI finds the bugs and humans have to understand them, I write about what I'm actually figuring out. Follow for more field notes from the bottom of the learning curve.