The XRP Ledger paid just $250,000 to the researcher who found a way to mint what observers called "infinite XRP," and industry commentators are now calling that bounty too small. Crypto news outlet Protos branded the payout "cheap" in a report on the award, arguing the figure sits far below what comparable critical vulnerabilities fetch elsewhere in the industry.

The backstory matters here. A security researcher demonstrated that a flaw in the XRP Ledger's code could, in principle, allow the creation of unbounded XRP — the kind of bug that, if weaponized before patching, would undermine the ledger's entire monetary supply. Instead of exploiting it, the researcher reported the flaw. The response earned them a quarter of a million dollars.

Why is a $250K payout controversial?

Bug bounties are insurance. They price the risk a platform avoids when a white-hat researcher walks in the door instead of a black hat.

On that logic, critics say the XRP Ledger got a bargain. Vulnerabilities of similar severity on other major chains and exchanges have drawn rewards running into millions of dollars. Immunefi, the industry's largest bug bounty platform, regularly lists maximum payouts well above $1 million for critical findings. A bug that touches token supply — the atomic core of any ledger — would ordinarily sit at the very top of that scale.

The concern is straightforward. If payouts lag the market, researchers have less reason to disclose responsibly. The next person to find a supply-breaking flaw might not file a report.

What does this change for the XRP Ledger?

Not much on-chain. The flaw itself has been disclosed publicly, which means it has been addressed or contained, and no exploit drained funds. The ledger's day-to-day operations continue as before.

The consequences are reputational and economic. Security economics runs on incentives. A platform that underpays for its most dangerous bug class signals, intentionally or not, that it values those findings below market rate. That signal reaches exactly the audience a chain least wants to alienate: the skilled researchers who decide whether to disclose or to sell elsewhere.

It also lands at a sensitive moment. The XRP ecosystem is still absorbing the regulatory clarity that followed Ripple's long-running case with the U.S. Securities and Exchange Commission, and institutional adoption of XRPL-based products depends on the perception that the ledger's security program is first-rate. A debate over bounty sizing is the kind of quiet credibility leak that compounds.

The wider bounty market

The episode fits a broader pattern. Payouts across the crypto sector vary wildly, with some protocols paying seven figures for critical bugs while others offer sums that would not cover a senior engineer's salary. Researchers have complained for years that the gap between crypto's systemic risk and its bounty budgets remains wide.

That gap has a cost. Chains do not get to choose whether their bugs are found. They only get to choose, through the incentives they set, who finds them first and what that person does next.

Expect the scrutiny to sharpen. As bug bounty platforms publish more payout data and researchers compare offers publicly, underpaying for critical findings will get harder to hide — and protocols that lag the market may find out the true price of their next vulnerability only after it is too late.