XRP Ledger Odometer Almost Clicked Past 100 Billion — Bug Busted With 3 Days to Spare 🪙

A decade-old integer-overflow bug in the XRP Ledger's payment engine could have let an attacker mint spendable $XRP from nothing, breaking the network's fixed supply cap of 100 billion tokens, according to a security report published Friday. RippleX, the developer arm of Ripple, said it found no evidence the flaw was ever exploited on a public network. The vulnerability, believed to date to 2015, was reported through the XRPL bug bounty program on Sept. 22 by researcher Cayden Liao and Veria AI. The disclosure was published Oct. 9, 2026.

The attack exploited the ledger's built-in decentralized exchange, where accounts post offers to swap one token for another. An attacker would open hundreds of accounts, have each list a tiny token offer in exchange for an unusually large amount of $XRP, and then send a single payment that filled every offer at once. The total $XRP owed became larger than the software's counter could track, causing it to reset and effectively charge the buying account almost nothing while paying out full $XRP amounts to the selling accounts. A post-transaction safety check designed to detect any new $XRP used the same miscounted total and therefore missed the discrepancy. A separate per-account receive limit did not trigger because the minted $XRP was spread across hundreds of receiving accounts. The researchers' method required roughly a few hundred $XRP to open the accounts — most of which could later be recovered — plus standard transaction fees.

Developers shipped the fix in xrpld 3.4.1 on Sept. 25 without disclosing what it repaired. According to RippleX, more than 80% of default validators upgraded on release day before the fix's code was published. The change bypassed the network's usual amendment process, which requires backing from more than 80% of trusted validators over two weeks, and RippleX indicated this was the first time a transaction-processing change had been deliberately shipped that way since the amendment system was introduced more than ten years ago. RippleX said a public vote would have exposed the bug in open code for weeks while it remained exploitable, and added that future changes will continue to go through the validator vote. The report said the decision was made jointly by the XRPL Foundation, RippleX, and validators.

The vulnerability is the latest in a series of long-hidden crypto flaws surfaced with the help of AI since July, including a Coldcard wallet bug tied to the theft of at least 1,367 $BTC and vulnerabilities that prompted Core Lightning to advise bitcoin node operators to disconnect. $XRP traded near $1.41 at the time of reporting, giving the capped supply a market value of roughly $88.8 billion.