XRP Ledger Bug Explained: How a Decade-Old Flaw Could Have Minted XRP From Nothing, and Why the 100 Billion Cap Held

The XRP Ledger's payment engine contained an integer overflow bug, dating back to code written in 2015, that could have let an attacker create XRP from nothing in a single transaction. Developers disclosed it on Friday, October 9, 2026.

Researcher Cayden Liao and Veria AI reported the flaw through the XRPL bug bounty program on September 22. RippleX merged a fix the next day and shipped xrpld 3.4.1 on September 25, when more than 80% of default UNL validators were already running it.

RippleX says it has "found no evidence that this issue was exploited on any public network." Liao estimates a single exploit could have created about 18 trillion XRP, far beyond the 100 billion XRP that will ever exist.

For the first time since the amendment system was introduced, a change to transaction processing took effect without a validator vote, a trade-off critics say left the network running unpublished code for about two weeks.

XRP barely reacted and trades near $1.39, while validators weigh the LendingProtocol amendment, which has 17 votes and needs roughly 80% support held for two weeks.

 

 

On October 9, the XRP Ledger's developers published a vulnerability disclosure report for xrpld 3.4.1 covering two bugs. The serious one is summed up in a single line of the report: "an integer overflow in the payment engine could be exploited to create XRP from nothing." It was rated Major when reported and upgraded to critical after testing, with the report noting, "If it had been exploited, this would have been a critical issue." The second, lower-severity bug involved how Batch transactions wrap inner transactions. It could have caused nodes to disagree on validity but put no funds at risk, and its fix, fixBatchV1_2, activated alongside the Batch feature on October 9.

 

The XRP Ledger has a built-in decentralized exchange where users place offers to trade XRP and other tokens. When one payment consumes many offers at once, the payment engine adds their amounts together. "XRP balances are stored as integers with a fixed maximum," the report explains, and when the sum exceeded that maximum it "wrapped around to a small number" instead of failing. The engine then "paid each offer owner their full amount individually but charged the buyer only the wrapped-around total." The difference was XRP that had never existed.

The ledger has a safety check, known as an invariant, that is designed to catch any creation of XRP, but it used the same unchecked arithmetic and missed the problem. "We suspect one reason nobody caught this vulnerability is that it chains together two bugs," Liao said, according to The Block. Pulling it off would have required hundreds of deliberately mispriced offers and one payment to fill them, costing only a few hundred XRP in mostly refundable reserves plus fees. The report stresses that "the attack could not be triggered by accident," which is why more than a decade of normal trading never exposed it.

 

The discovery says as much about security research as it does about the XRP Ledger. Veria Labs says its AI agent found the flaw and built a working exploit before Liao filed the report through the bug bounty program. Liao said Ripple paid the program's maximum bounty of $250,000, which he described as "the largest ever paid out for a vulnerability discovered entirely by an AI agent," to his team's knowledge. RippleX head of engineering J. Ayo Akinyele put the broader lesson plainly: "AI is fundamentally changing how quickly vulnerabilities can be discovered."

 

The response moved fast. The bug was reported and confirmed on September 22, the fix was merged on September 23, and xrpld 3.4.1 shipped on September 25 as "an emergency release to fix security-sensitive issues in the XRPL protocol." Normally, changes to how transactions are processed go through the amendment system, which requires more than 80% validator support held for two weeks. Because xrpld is open source, a public vote would have advertised the bug for weeks before the fix took effect. "The deciding factor was severity," the report says. "We judged a short upgrade window with this limited risk to be far safer than weeks of a publicly known, open exploit." The fix instead took effect as each server upgraded, and the source code was published about two weeks after the release.

Not everyone is comfortable with that precedent. Cyber Capital founder Justin Bons, a longtime XRP critic, said that "XRP has been running closed-source code for the last two weeks." RippleX engineer Mayukha Vadari countered that AI-assisted reverse engineering makes it impossible to slip a critical fix quietly into a routine public release. All server operators now need xrpld 3.4.1 or newer to stay in sync, as older servers are amendment-blocked.

 

According to the report, yes. "We have found no evidence that this issue was exploited on any public network," RippleX wrote, and the safety check that missed the overflow now uses a wider counter that cannot overflow. That statement is a finding from RippleX's review rather than a mathematical proof, but the attack required a conspicuous pattern of hundreds of absurdly priced offers that would be hard to hide on a public ledger. Liao's estimate of about 18 trillion XRP from a single transaction shows what was at stake: researchers valued XRP at roughly $94 billion when they filed the report, and an exploit on that scale would have threatened the entire network's value.

 

 

The market treated the disclosure as a resolved issue. XRP opened at $1.38 and closed at $1.39 on October 9 and has traded near $1.39 to $1.40 since, down roughly 24% this year. Attention is shifting to governance. The LendingProtocol amendment, which would allow loans to be issued and collateralized directly on the ledger, had 17 validator votes on October 11, up from 14 on October 6, and needs roughly 80% support sustained for two weeks to activate. Separately, the fixCleanup3_4_0 amendment reached its majority on October 9 and is set to activate on October 23.

 

For holders, there is nothing to do. The fix was live on most of the network before the bug was public, and no XRP balances were affected, so any message claiming you must "migrate" or "verify" XRP because of this bug is a scam. For traders, the episode is a reminder that protocol risk is real even on a network that has run since 2012, and that well-funded bug bounties and fast coordination are what turned a potential disaster into a footnote. Traders can follow XRP/USDT on MEXC for the market reaction as the lending vote develops, manage exposure with stop-loss orders on MEXC Futures.

 

Disclaimer: This content is for educational and reference purposes only and does not constitute any investment advice. Digital asset investments carry high risk. Please evaluate carefully and assume full responsibility for your own decisions.