Odometer Broke, Printer Went Brrr: A Decade-Long XRP Ledger Bug Almost Printed 18.5T From Thin Air 🚨

A decade-old integer overflow in the $XRP Ledger's payment engine could have let an attacker mint approximately 18.5 trillion spendable $XRP — vastly exceeding the network's original 100 billion $XRP supply, according to a vulnerability disclosure report published Friday. The flaw, believed to date to 2015, was reported through the XRPL Bug Bounty program on Sept. 22 by researcher Cayden Liao and Veria AI. Engineers at RippleX, Ripple's developer arm, reproduced the attack on a standalone server and confirmed the newly created $XRP could be spent in a later transaction. RippleX said it found no evidence the flaw was exploited on any public network, and the XRP Ledger Foundation confirmed the total supply remains fixed at 100 billion $XRP since the ledger launched in 2012, with current circulating supply at almost 99.986 billion $XRP due to fee burning.

The attack worked through the ledger's built-in exchange, where accounts post offers to swap one token for another. An attacker could open hundreds of accounts, have each one offer a tiny amount of a token in exchange for an unusually large amount of $XRP, then send a single payment that bought every offer at once. $XRP balances are stored as 64-bit integers with a fixed maximum; when the total $XRP owed exceeded that maximum, the calculation wrapped to a smaller number instead of failing, much like an odometer rolling past its limit. The selling accounts were paid in full while the buying account was charged almost nothing, leaving the attacker with $XRP that hadn't existed before. A post-transaction safety check relied on the same miscounted total and missed the gap, and a separate limit on how much $XRP a single account can receive wouldn't have triggered either, because the attack spread the proceeds across hundreds of accounts.

Developers shipped the fix in xrpld 3.4.1 on Sept. 25, deliberately bypassing the ledger's standard amendment process — which normally requires more than 80% trusted validator support for two weeks — because a public vote would have exposed the fix's code for weeks while the bug stayed exploitable. "With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security," XRPL developers said in an X post on Sunday. "This is the first time a change to transaction processing has deliberately shipped this way since the amendment system was introduced more than ten years ago," RippleX indicated. More than 80% of default validators upgraded on release day before the fix's code was published, and the XRPL Foundation said the decision was made jointly by the Foundation, RippleX, core developers and validators, adding that "no single party could make that call alone" and that protocol changes still go through amendments. Kuwait, an independent validator operator, said, "We disagree with the claim that operators coordinating an update is, in itself, proof of centralized control. Coordination is not the same as control." $XRP was trading at $1.41, giving the cap a market value of about $88.8 billion.

The disclosure follows a string of long-hidden crypto security flaws surfaced with AI help since July, including the Coldcard wallet bug behind the theft of at least 1,367 $BTC and vulnerabilities that forced Core Lightning to tell bitcoin node operators to disconnect. It also landed a day after Cyber Capital founder Justin Bons called selling $XRP as decentralized "fraud" in a public debate with Ripple's David Schwartz over $XRP decentralization.