Security remains our top priority for preserving trust in the XRP Ledger (XRPL). Sharing a few thoughts following yesterday's disclosure of the critical payments engine vulnerability reported by Veria AI. First, this was a serious vulnerability, and we don't take that lightly. The bug had existed in the codebase for over a decade and could have allowed XRP to be created beyond its fixed supply. Fortunately, it was discovered through our bug bounty program before it could ever be exploited. Second, our response was fast and coordinated. The team developed and thoroughly tested a fix, worked closely with validators to rapidly upgrade the network, and secured the ledger before public disclosure. I'm proud of how everyone came together to address the vulnerability and protect the XRPL network. But there's a much bigger lesson here. AI is fundamentally changing how quickly vulnerabilities can be discovered. We have to move even faster than before, especially with a codebase that's been around for over a decade. This means we're doubling down in a few important areas: * Proactive security: Strengthening our bug bounty programs, expanding AI-assisted vulnerability discovery/adversarial testing, and continuously improving testing across releases. This discovery reinforces why these investments matter. * Addressing legacy tech debt: Working with our internal red team, external security researchers, and the XRPL Foundation to revisit longstanding assumptions in critical areas like payments engine, consensus, and P2P networking, guided by an updated threat model. * Accelerating formal verification of critical areas: Continuing our work with CommonPrefix and the XRPL Foundation to apply formal verification to critical parts of the protocol, with the goal of uncovering deeper issues that other approaches could easily miss. We will build on the learnings from formal verification of the Lending Protocol and Single Asset Vault. * Systemic hardening: Moving beyond individual bug fixes to identifying latent risks in older parts of the XRPL codebase and eliminating entire classes of vulnerabilities. Our goal isn't simply to find more bugs. It's to systematically address the underlying risks and make the XRPL harder to exploit. As the XRPL's role in global financial infrastructure grows, so does our responsibility to protect it. Security is never finished. We'll keep investing and improving alongside the broader XRPL community. Full disclosure for the 3.4.1 release: