XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing

Introduction

A critical vulnerability in the XRP Ledger—dating back to its 2015 codebase—was disclosed and patched in September 2026. The bug allowed a crafted payment to create and spend XRP without the sender providing the necessary funds, theoretically enabling the creation of billions of new tokens and threatening the network’s 100‑billion‑XRP supply cap. Researchers demonstrated the exploit on a private server, prompting an emergency software release from RippleX.

How the flaw worked

The XRP Ledger includes a built‑in decentralized exchange where accounts post offers to trade one asset for another. The exploit leveraged a counting error in this exchange:

1. An attacker opens hundreds of accounts, each posting a tiny offer to sell a low‑value token for a massive amount of XRP.
2. The attacker then sends a single payment that matches all of those offers at once.
3. Because the ledger’s accounting logic mis‑counts the total XRP owed across many accounts, the buyer is charged only a negligible fee while each seller receives the full XRP amount.
4. The result is newly minted XRP that never existed on the ledger, violating the immutable supply rule.

The ledger’s usual post‑transaction check—intended to detect any net increase in XRP—relied on the same mis‑counted total, so it failed to flag the anomaly. Additionally, per‑account receipt limits were bypassed because the newly created XRP was distributed across many accounts.

Discovery and response

Security researcher Cayden Liao, in collaboration with Veria AI, identified the issue and reported it internally to RippleX on September 22, 2026. The team reproduced the attack on an isolated server, confirming that the newly generated XRP could be spent in subsequent transactions. RippleX quickly released version 3.4.1 of the `xrpld` server software on September 25, fixing the counting logic and adding safeguards to prevent similar exploits.

RippleX emphasized that no evidence of the bug being exploited on any public network was found. The patch was deployed without a detailed public disclosure of the exact code change, a common practice to avoid giving potential attackers further insight.

Implications for the ecosystem

The incident underscores several broader points for the cryptocurrency community:

• Legacy code risks: Even mature, widely used blockchain platforms can harbor hidden flaws that persist for years.
• AI‑assisted research: The involvement of Veria AI reflects a growing trend of AI tools aiding security audits and vulnerability discovery.
• Supply‑cap integrity: For assets like XRP, whose value proposition includes a fixed supply, any breach of that guarantee can erode institutional trust.
• Rapid response matters: RippleX’s swift patching and transparent communication helped mitigate market panic and reinforced confidence among users and regulators.

Practical takeaways

• Node operators should update to `xrpld` 3.4.1 or later immediately to protect against the exploit.
• Developers building on the XRP Ledger should review transaction‑validation logic, especially when interacting with the built‑in exchange.
• Institutions relying on XRP’s supply guarantee may want to monitor future security audits and consider diversified exposure.
• Community members are encouraged to stay informed about security disclosures and participate in bug‑bounty programs that help surface hidden vulnerabilities.

Conclusion

The patch of this decade‑old bug restores the integrity of the XRP Ledger’s fixed‑supply model and highlights the importance of continuous security scrutiny, even for established blockchain protocols. By addressing the flaw promptly and confirming no public exploitation, RippleX has reinforced confidence in XRP’s technical foundations while reminding the broader crypto ecosystem that vigilance remains essential.