Avalanche Founder Warns AI Could Uncover Bugs in Ripple’s Code

The crypto industry is watching the wrong threat, in Emin Gün Sirer's view. The Avalanche founder argues the AI debate has fixated on the day machine intelligence cracks ECDSA, the signing method behind most crypto wallets, when the nearer danger is far duller: AI finding ordinary bugs in code.

He made the case in a post on X and pointed at Ripple's code as his example. He did not name a single unpatched flaw in the XRP Ledger, and he did not show an AI attacking it. The argument is a warning about where the next large theft comes from, not evidence of one happening now.

The wording quoted below comes from pages that reproduce the post, including its embedded card. The post's exact date could not be checked against X itself, because x.com blocks automated readers.

What Sirer Actually Said

His claim is narrower than the headlines it produced. Sirer said the industry is too focused on cryptographic breakthroughs, and should pay more attention to the risk of AI detecting important software vulnerabilities. In his telling, AI will exploit system-level bugs well before ECDSA becomes obsolete. Advanced models could find flaws in blockchain software, libraries and wallets that human reviewers have missed, bugs the community has not yet detected. Attackers could use them to steal billions long before cryptography breaks.

"If you believe, for instance that Ripple's (or put any other high-value, low-use chain here) under-scrutiny code has no 0-day bugs that are hard for humans to see but easy for AI to detect, you're a deluded person."

He is not saying Ripple has a bug. He is saying you should not assume it does not, and that a low-use, high-value chain gets less review than it deserves.

He has sparred with Ripple's camp before. Ripple CEO Brad Garlinghouse criticized Sirer earlier over claims about Ripple's traction with banks.

The wider debate has drawn in others. Ethereum co-founder Vitalik Buterin recently warned that AI-driven mathematical discovery could threaten lattice-based cryptography within two years. Cardano's Charles Hoskinson called those concerns speculative, saying math cannot back up such predictions. Ethereum researcher Justin Drake has raised the prospect of AI eventually attacking ECDSA.

The XRP Ledger Bug That Was Real

Two weeks before the post, the XRP Ledger shipped an emergency fix. Version 3.4.1 of xrpld, the reference server, arrived on September 25 with a new amendment, fixBatchV1_2, set to a default Yes vote. The official release notice says the amendment already had supermajority validator support and was expected to become enabled on 2026-10-09, after which servers that had not updated would become amendment blocked.

The source code for that release was withheld at first, because of the security-sensitive nature of the fix, with a promise to publish it alongside a retrospective. The changelog lists a Batch wrapper fix, rejecting inner transactions with the wrong wrapper, plus integer-arithmetic hardening in the payment engine and ledger helpers.

A disclosure published October 9 explained what was at stake. A critical vulnerability in the payment engine, believed to have existed since 2015, could have let an attacker generate XRP beyond the network's hard cap of 100 billion tokens. The cause was an integer overflow in the payment engine's offer aggregation logic: summed offer amounts overflowed, and the buyer was charged only the wrapped amount, creating XRP.

Researchers Cayden Liao and Veria AI found it and reported it through the ledger's bug bounty program on September 22. The fix landed three days later, applied without the standard amendment voting process for the first time in more than a decade. RippleX said it found no evidence the flaw was exploited on any public network. The disclosure confirmed the withheld source code had since been released.

Why the Two Are Not Linked

The release materials do not say AI discovered the vulnerabilities fixed in 3.4.1, and they offer no evidence that AI compromised the XRP Ledger, defeated ECDSA or caused funds to be stolen. The October disclosures did not attribute either vulnerability to artificial intelligence, and nothing available ties the September fixes to Sirer's warning.

One of the two credited researchers is named Veria AI. That is a name, not a finding. No available material says the flaw was located by artificial intelligence, and the disclosure does not claim it.

The distinction matters for how you read the week. XRP holders got a patched payment engine bug and a warning about a category of bug, not an unpatched hole sitting open. Code-level failure, rather than a broken signature scheme, is the recurring theme in crypto's worst days. Uniswap's StablePair hook is a recent example, with three hidden flaws that could hit LP returns.

What to Watch Now

The retrospective and the published source code should show exactly what the payment engine flaw allowed, and how close it came to the supply cap. That is the document to read before drawing conclusions about what could have happened.

On the network side, fixBatchV1_2 was due to switch on around October 9, and any server still running an older build becomes amendment blocked until it updates. If you run a node, that is the immediate item.

The open question Sirer raised is not settled: nobody has publicly demonstrated an AI discovering a live flaw and using it. His bet is that the first case will look like an ordinary code bug, not a maths breakthrough. Until something shows that, it stays a prediction.