A significant security flaw in the XRP Ledger's payment software could have allowed attackers to create approximately 18.5 trillion XRP through a single specially designed transaction, according to the latest security report. As reported by RippleX, the bug had likely remained undetected since 2015 and could have been exploited to mint new XRP without any underlying assets. The vulnerability was discovered by researcher Cayden Liao and Veria AI through the XRPL bug bounty program on September 22, 2026, with the flaw existing in xrpld versions 3.4.0 and earlier. The XRPL Foundation and RippleX confirmed the vulnerability in an October 9 disclosure, explaining that an error in the network's payment engine could have produced spendable XRP beyond its intended 100 billion supply. The XRPL Foundation revealed that no normal payment comes anywhere near triggering the bug, requiring hundreds of deliberately constructed operations to activate the flaw.
The exploit mechanism involved creating hundreds of specially priced offers and arranging for one payment to consume them simultaneously. According to the security report, when the calculated total exceeded the integer's maximum value, the number could wrap around to a much smaller amount. The system would still credit individual sellers with the full XRP amounts specified in their offers, even though the buyer paid only the reduced amount produced by the overflow. The resulting cryptocurrency could be transferred to other accounts, traded or sent to exchanges, as described in the official disclosure. The vulnerability could not be triggered through ordinary trading and required an attacker to create several hundred accounts with unusually priced offers and submit a carefully constructed transaction. The existing security checks failed because the system's supply verification used the same type of arithmetic that caused the original error.
RippleX released an emergency fix in server software version 3.4.1 on September 25, 2026, which took effect immediately after each operator upgraded rather than waiting for the standard validator vote process. According to the official disclosure, developers added checks that prevent the payment engine from accepting calculations exceeding the permitted integer range, with the updated software rejecting affected calculations and returning an ordinary payment failure instead of creating additional XRP. The company justified bypassing the normal validator vote requirement, which requires backing from more than 80% of trusted validators for two weeks, citing concerns that a public vote would expose the exploitable bug for weeks. By September 25, more than 80% of validators on the default Unique Node List had upgraded to version 3.4.1. The rapid software rollout is distinct from the ledger's amendment process, with the supply-flaw fix taking effect as servers upgraded to the patched release.
Security researcher Cayden Liao and Veria AI received the maximum $250,000 bounty for identifying and responsibly disclosing the issue, with Veria Labs publishing its findings on October 10 describing how its automated security testing system discovered the issue on September 21. The demonstration showed that approximately 18.5 trillion XRP could be created through one specially designed transaction, equivalent to roughly 184 times XRP's intended total supply. RippleX engineers reproduced the problem on a standalone server and confirmed that the newly generated XRP could be spent in a subsequent payment. The initial report classified the vulnerability as major, but developers raised its severity to critical after confirming the potential consequences. The XRPL Foundation explained that the vulnerability could have placed XRP's entire market value at risk if attackers had successfully exploited it, based on an approximately $94 billion XRP market capitalization at the time. However, no damage was done according to RippleX, which shipped the fix, with no new XRP created and about 99.986 billion XRP remain in circulation today.
The discovery also highlighted the risks associated with legacy blockchain code, as the vulnerable BookStep aggregation code dated back to 2015, while the XRPNotCreated invariant had been present since 2017. Both code paths had remained in the software for years before the vulnerability was identified, demonstrating how dormant vulnerabilities can persist in established systems. The incident also raised questions about the growing role of artificial intelligence in cybersecurity, as AI-assisted tools can help researchers uncover dormant vulnerabilities in established software, but they can also lower the effort required for attackers to identify exploitable weaknesses. RippleX executive J. Ayo Akinyele outlined the response on X on October 10, after disclosure on Friday, October 9, emphasizing that "AI is fundamentally changing how quickly vulnerabilities can be discovered." The XRPL patch addressed a potentially serious threat without evidence of exploitation on a public network, though the theoretical 18.5 trillion XRP figure illustrates the vulnerability's potential scale.
