Peter Todd, the Canadian Bitcoin developer recently identified in an HBO documentary as the most likely person behind the Satoshi Nakamoto identity, has reignited criticism of Ripple after a major vulnerability was discovered in its ecosystem.
A JavaScript library used in the XRP Ledger (XRPL) SDK was found to contain a malicious backdoor, prompting Todd to call out Ripple’s long-ignored security practices.
According to Aikido Security, the backdoor made it possible to transmit private keys to an unknown external domain. This vulnerability placed developers and users relying on the XRPL SDK at significant risk of private key theft and fund compromise.
Todd responded with a pointed message on social media, saying he had warned about this exact risk nearly ten years ago. He had previously published concerns about Ripple’s failure to provide PGP-signed code, warning that such gaps could allow attackers to slip in malicious software undetected.
Also Read: $TRUMP Coin Soars 60% as Top Holders Get Gala Dinner With President Trump
His message carried additional weight given his new public profile following the documentary that connected him to Bitcoin’s origins. While Todd has consistently denied being Satoshi, his insights into early crypto security have made his warnings difficult to ignore.
10 years after I pointed out the risk of a Ripple backdoor due to Ripple not PGP signing their software or providing any other way to get it securely… there’s a a Ripple backdoor due to an npm compromise. 😂https://t.co/5Z3x68KeB5 pic.twitter.com/IkR3sG3pfd
— Peter Todd (@peterktodd) April 23, 2025
Ripple’s Chief Technology Officer, David Schwartz, confirmed the presence of the backdoor and acknowledged that Todd’s warning was accurate, at least at the time it was made. However, this admission has led many to ask why those early red flags were not acted upon.
Ripple Under Fire as Todd’s Decade-Old Security Warning Materializes
The method of attack mirrored what Todd described years ago. It involved distributing a compromised version of the XRPL SDK via NPM, a common JavaScript package platform, allowing attackers to extract sensitive key information from users.
Todd highlighted that, although his own library lacks PGP signatures today, that is due to changes on the Python Package Index (PyPi), which removed support for such verification. He criticized the broader software industry for making decisions that weaken security infrastructure.
He acknowledged Ripple possessed an obvious opportunity to adopt best practices on its own, but the company failed to take advantage of this opportunity. This predictable breach emerged because of preventable errors that affect Ripple’s development practices reliability as disclosed by him.
Blockchain development professionals are showing growing apprehension due to this recent occurrence. Security experts are compelling organizations to adopt strict protective measures for their open-source code and complete software integrity verification.
The discovery of Ripple’s backdoor marks a major failure in protecting user trust because Peter Todd previously warned about Ripple’s security weaknesses. The comprehensive warning highlights to blockchain developers that disregarding professional guidance results in extensive negative outcomes.
Also Read: Crypto Market Prices Update – April 24
