The XRP Ledger has disclosed details of a critical software vulnerability that could have allowed attackers to create trillions of unauthorized XRP, potentially undermining the cryptocurrency’s fixed supply and the integrity of its payment network.
The flaw, believed to have existed since 2015, was discovered through the XRPL bug bounty program and corrected in the xrpld 3.4.1 software release on September 25, 2026.
The XRP Ledger development team published its vulnerability report on October 9, confirming that the issue affected the payment engine responsible for processing transactions through the network’s decentralized exchange.
According to the disclosure, an attacker could have exploited an integer overflow to create spendable XRP in a single validated transaction, exceeding the cryptocurrency’s original 100 billion XRP supply limit. Developers found no evidence that the vulnerability had been exploited on any public network.
The discovery was credited to Cayden Liao and Veria AI, whose research identified the accounting weakness before it could be used against the live network.
How an Arithmetic Error Threatened XRP’s Supply
The vulnerability originated in the payment engine’s handling of transactions involving multiple decentralized exchange offers.
When processing a payment through an order book, the engine aggregates the XRP amounts owed across the offers being consumed.
However, the software used ordinary 64-bit integer addition without adequately checking whether the combined amount exceeded the maximum representable value. An attacker could construct hundreds of unusually priced offers and execute a payment designed to consume them together.
Once the accumulated value exceeded the integer limit, the calculation could wrap around to a much smaller number. The system would consequently credit the offer owners with their full XRP amounts while charging the paying account only the incorrectly calculated total.
Existing safeguards intended to prevent unauthorized XRP creation contained a related weakness, allowing the accounting discrepancy to escape detection. Researchers reproduced the exploit in a standalone testing environment and confirmed that the newly created XRP could subsequently be transferred.
The attack required only a few hundred XRP in account and offer reserves, most of which could be recovered afterward. Importantly, ordinary trading activity could not accidentally trigger the vulnerability. Exploitation required a deliberately constructed sequence of offers and payments.
Emergency Patch Bypassed Normal Amendment Process
RippleX engineers reproduced the issue on September 22 and raised its severity from major to critical. The development team prepared and reviewed a fix before incorporating it into xrpld version 3.4.1, released three days later.
The patch introduces overflow checks when aggregating payment amounts and strengthens the invariant checks designed to detect unauthorized XRP creation. Unlike most XRP Ledger protocol changes, the correction took effect when validators upgraded their software rather than waiting for a conventional governance amendment.
Ordinarily, amendments require support from more than 80% of trusted validators for two weeks before activation.
Developers considered the potential consequences of delaying this particular fix more serious than the operational risks associated with an accelerated deployment.
More than 80% of validators on the network’s default Unique Node List had upgraded by September 25. The same software release also addressed a separate batch-transaction validation vulnerability, with its associated amendment activating on October 9.
The disclosure highlights the importance of security testing in mature blockchain networks. Although XRP’s supply rules were established at the network’s inception, the vulnerability demonstrated that implementation errors could potentially undermine those rules without formally changing them.
The incident also illustrates the value of coordinated vulnerability disclosure, independent research and rapid validator upgrades. No unauthorized XRP creation has been identified on public networks, and the affected payment-engine calculations have now been hardened.
For XRP holders, the significance lies not in an actual supply increase, but in the prevention of an exploit that could have fundamentally compromised the network’s monetary integrity.