For 10 Years the XRP Ledger Was Basically a Counterfeit Press With a Speed Bump

A decade-old integer-overflow flaw in the XRP Ledger's payment engine could have let an attacker mint spendable $XRP out of thin air, according to a vulnerability disclosure report published Friday. The bug, believed to date to 2015, was reported through the XRPL Bug Bounty program by researcher Cayden Liao of Veria AI on Sept. 22. Engineers at RippleX, Ripple's developer arm, reproduced the attack on a standalone server and confirmed the newly created $XRP could be spent in a later transaction. RippleX said it found no evidence the flaw was ever exploited on any public network, and the $XRP Ledger Foundation confirmed total supply remains fixed at 100 billion $XRP, all of which were created when the ledger launched in 2012.

The attack exploited the ledger's built-in exchange, where accounts post offers to swap one token for another. An attacker would open hundreds of accounts, have each one offer a tiny amount of a token in exchange for an unusually large amount of $XRP, then send a single payment that bought every offer at once. Because $XRP balances are stored as 64-bit integers with a fixed maximum, the total the buyer owed wrapped around to a small number, paying each selling account in full while charging the buyer almost nothing. The post-transaction check meant to confirm no new $XRP had been created relied on the same miscounted total and missed the discrepancy, and the per-account receive limit did not trigger because the proceeds were split across hundreds of accounts. Researchers estimated the theoretical damage at roughly 18.5 trillion spendable $XRP. The attack required only a few hundred $XRP to open the accounts, most of which could be recovered, plus transaction fees.

Developers shipped the fix in xrpld version 3.4.1 on Sept. 25, three days after the report, without publicly disclosing what it repaired. The release bypassed the ledger's standard amendment process, which normally requires more than 80% of trusted validators to back a change for two weeks before it activates. "This is the first time a change to transaction processing has deliberately shipped this way since the amendment system was introduced more than ten years ago," RippleX said. RippleX and the XRPL Foundation said a public vote would have exposed the bug in open code for weeks while it stayed exploitable. More than 80% of default validators upgraded on release day, before the fix's code was published. The XRPL Foundation said the decision to skip the normal amendment process was made jointly by the Foundation, RippleX, core developers and validators, and that protocol changes still go through amendments. Independent validator XRP Kuwait added, "Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence."

The disclosure drew criticism from Cyber Capital founder Justin Bons, who said Thursday that marketing $XRP to retail investors as decentralized amounted to "straight-up fraud," a day before the report's publication. The XRPL Foundation, in an X post on Sunday, said, "With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security."

The episode lands in a wider run of long-hidden crypto flaws surfaced with AI assistance since July, including the Coldcard wallet bug behind the theft of at least 1,367 BTC and the vulnerabilities that prompted Core Lightning to tell bitcoin node operators to disconnect. $XRP traded at $1.38 on Monday, down 1.6% over 24 hours and 9.4% over seven days, with a market capitalization of about $88.8 billion at $1.41 per token.