Initial Report of Anomalous On-Chain Activity
An XRP Ledger validator known as Vet reported unusual on-chain activity involving a well-known custody provider. The initial update described a surge in account activations, a spike in AccountSet transactions, and an increase in the number of multisignature operations, all occurring across a concentrated short period. Vet indicated uncertainty about the actor behind the activity, but flagged the pattern as notable and worthy of further attention from observers and developers monitoring ledger health.
Technical Explanation: Failed Transactions Due to Scripting Error
In a subsequent update, VET clarified that the earlier anomaly had a technical explanation. According to the validator, a custody provider’s internal script began issuing repeated transactions that did not complete because the provider’s account depleted its XRP balance. The validator characterized the behavior as the result of an erroneous loop in the provider’s automation that repeatedly attempted transactions until funds were exhausted, which produced a stream of failed entries on the ledger. The validator described the failed attempts as automated and unintentional rather than deliberate network abuse.
BitGo topped up their account with fresh XRP and continues to activate accounts again, this time successfully.
What they up to remains unknown.
Hope the script is fixed now. https://t.co/FXVYqLaJy5 pic.twitter.com/lGbl0kNtwO
— Vet (@Vet_X0) November 12, 2025
Resumption of Activations Following Funding
Vet’s most recent message confirms that the custody provider replenished its account with XRP and resumed successful account activations. The validator noted that account activations are now completing as intended, but emphasized that the underlying purpose of the batch activations remains unclear. Vet expressed a cautious hope that the scripting issue that produced the earlier failed transactions has been corrected, while leaving open the question of what the provider’s operational objective is for the renewed activation activity.
Ledger Snapshots Provide Context
Images attached by the validator show an account labeled as a custody initialization wallet and list multiple outgoing payment transactions dated 11/12/2025 with individual amounts of 1.222500 XRP. The account summary in those snapshots records an available balance above 1,000 XRP after recent activity and traces the account’s activation and transaction history. Those ledger entries corroborate the validator’s reporting of a high volume of activation-related transactions occurring within a short timeframe and of a period in which transactions failed when the account reached a low balance.
Implications and Unresolved Questions
The sequence of reports from the validator frames the incident as operational rather than malicious: automated scripts generating repeated attempts, a temporary depletion of funds, replenishment followed by resumed operations. Key questions remain unanswered, chiefly the explicit intent behind the large-scale activations and whether any internal controls were changed to prevent future automation errors. VET’s updates leave the matter open to further technical review by validators, node operators, and the custody provider involved, who may need to disclose remedial steps to prevent recurrence.