Ripple has teamed up with leading blockchain security platform Immunefi to launch a $200,000 “Attackathon” — a large-scale bug bounty competition designed to test the security of the new XRPL Lending Protocol, which aims to bring institutional-grade, uncollateralized lending to the XRP Ledger (XRPL).
$200,000 Bug Bounty to Strengthen XRPL Security
The Attackathon will run from October 27 to November 29, 2025, inviting white-hat hackers and security researchers to identify vulnerabilities that could endanger fund safety or protocol solvency. The initiative is part of Ripple’s effort to ensure the lending protocol’s robustness before it goes live.
To prepare participants, Ripple will conduct an “Attackathon Academy” from October 13 to October 27, offering tutorials, walkthroughs, and Devnet environments for hands-on learning. The educational phase will help participants understand XRPL’s architecture and lending mechanisms before the live competition begins.
If a critical exploit is found during the event, the entire $200,000 reward pool will be unlocked. Otherwise, $30,000 will be distributed among participants who provide meaningful or near-critical discoveries.
XRPL Lending Protocol: Bridging Traditional Credit and DeFi
Governed under XLS-66, the XRPL Lending Protocol represents a novel approach to decentralized finance. Unlike typical DeFi systems that rely on smart contracts, wrapped assets, or on-chain collateral, this protocol leverages off-chain credit assessments conducted by financial institutions.
This design allows banks and credit providers to use their own risk models, while all loan issuance and repayment data are recorded directly on the XRP Ledger — ensuring transparency and regulatory compliance. Ripple envisions the system as a bridge between traditional credit markets and on-chain finance, offering both efficiency and trust.
Institutions requiring collateralized lending structures will still have the option to use licensed custodians or tri-party agreements, with XRPL serving as the execution layer.
Focus Areas and Technical Standards
Researchers will focus on vulnerabilities in vault logic, liquidation and interest calculations, and access control systems. Submissions must include reproducible proof-of-concepts to qualify for rewards.
The Attackathon will also test multiple XRPL standards, including:
- XLS-65 (single-asset vaults)
- XLS-33 (multi-purpose tokens)
- XLS-70 (credentials)
- XLS-80 (permissioned domains)
Ripple’s collaboration with Immunefi highlights the company’s proactive stance on DeFi security, ensuring the XRPL Lending Protocol is both resilient and compliant before its official deployment.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.