The XRP Ledger (XRPL) has disclosed a critical vulnerability in its payment engine that could have allowed an attacker to create new XRP beyond the network’s fixed supply of 100 billion tokens and spend the newly created assets like legitimate XRP.
Decade Old Flaw Found & Fixed
According to a vulnerability disclosure report published on October 9, 2026, the flaw remained undetected in the code for approximately a decade. Developers said it was fixed before any known exploitation. The vulnerability was addressed in xrpld 3.4.1, an emergency software release that also fixed another security-sensitive bug.
The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let’s clear them up.
1. Was any XRP created?
No. XRP’s supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around that rule, and 3.4.1 fixed it 2 weeks ago.
You don’t need to trust us on this. All ledger data is public, and explorers and data sites read it every day. New XRP would show up in account balances for everyone to see. There is no hidden place for XRP on the XRP Ledger, every balance is public.
We monitor the XRP Ledger 24/7 and have verified the supply throughout the history of the ledger. Others in the community verified this too, and anyone can do the same.
Transaction fees are destroyed, so the supply is deflationary. About 99.986 billion XRP exist today.
2. How did this go unnoticed, and what’s next?
No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations.
AI makes bugs like this faster to find, for the bad guys and the good guys.
Together with RippleX and the community, we will ensure the XRP Ledger is protected against such vulnerabilities. This means radically applying Formal Verification and AI adversarial testing, collaborating closely with security researchers, and strengthening the bug bounty program.
You’ll hear a lot more about this as we progress.
3. XRP Ledger decentralization at the core of this.
A public fix shows attackers where the bug is, and AI makes that fast. With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security.
As a reaction to this, the XRPL community came together, and among them the XRP Ledger Foundation, RippleX, core devs and validators formed a social consensus and agreed on a path forward that involves shipping the fix directly. Patching a live network is never trivial, so the plan was also designed to minimize disruption for everyone running on it.
We shared the build with the default UNL validators, using the contact details each one publishes in its xrp-ledger.toml file. Public binaries followed the same day, September 25.
No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments.
Big thanks to Cayden Liao and Veria AI for finding and reporting this responsibly, to the XRPL core developers for building and testing the fix, and to every node operator who upgraded so quickly, especially the validators.
Full report: https://t.co/aWxdvthYPt
— XRP Ledger Foundation (@XRPLF) October 11, 2026
The issue was described to the XRPL bug bounty programme by Cayden Liao and Veria AI on September 22, 2026. RippleX engineers replicated the problem, classified it as critical and established the emergency fix within days.
Integer Overflow Minting XRP
The flaw involved the XRP Ledger’s built-in decentralised exchange (DEX). When a payment consumes multiple offers from the order book, the payment engine calculates the XRP owed across those offers. According to the disclosure report, the calculation used plain 64-bit integer addition without an overflow check.
When the total exceeded the integer’s maximum value, the result could wrap around to a much smaller number instead of generating an error. The payment engine could then credit offer owners with their full requested amounts while charging the buyer only the wrapped-around total. This could effectively create XRP that should not have existed.
Emergency Patch Bypassed Standard Amendment Process
The XRPL Foundation, RippleX and more than 80% of validators supported organizing the emergency patch outside the network’s usual modification process. The unusual procedure reflected the severity of the issue and the need to address it without waiting for the standard process.
The disclosure was published after the xrpld 3.4.1 update had already been released. The September 25 announcement of the update did not initially make the payment-engine vulnerability public.
Developers said the issue was fixed before any known exploitation. The disclosure demonstrates the importance of integer-overflow checks and coordinated security reviews in blockchain payment systems. It does not establish that additional XRP was actually created or that the vulnerability was exploited.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment