The post AI tool catches bug that could have drained Ripple-linked token from wallets appeared on BitcoinEthereumNews.com.

An autonomous AI security tool caught a bug in the XRP Ledger that, if left undetected, could have let an attacker steal funds from any account on the network without ever touching the victim’s private keys. The vulnerability, disclosed Thursday by XRPL Labs, sat in the signature-validation logic of the Batch amendment, a pending upgrade that would allow multiple transactions to be bundled and executed together. The amendment was still in its voting phase among validators and had not been activated on mainnet, meaning no funds were ever at risk. But the exploit path was about as bad as it gets for a blockchain. Here’s what the bug did in plain terms. Batch transactions let users bundle several operations into one. Because the individual transactions inside the batch don’t carry their own signatures, the system relies on a list of batch signers to confirm that every account involved has authorized the bundle. The validation function that checked those signers had a critical loop error. If it encountered a signer whose account didn’t yet exist on the ledger, and whose signing key matched their own account — the normal case for a brand-new account — it immediately declared the entire check successful and stopped looking at the rest of the list. An attacker could exploit this by constructing a batch with three transactions. The first creates a new account the attacker controls. The second is a simple transaction from that new account, making it a required signer. The third is a payment from the victim’s account to the attacker. Because the new account doesn’t exist yet when validation runs, the signer check exits early after the first entry and never verifies the second. The victim’s funds move without their keys ever being involved. Pranamya Keshkamat and Cantina AI’s autonomous security tool…

---

Filed under: News - @ February 28, 2026 4:21 am