A decade-old flaw in the XRP Ledger's payment engine could theoretically have allowed attackers to create spendable XRP beyond the network's fixed supply cap of 100 billion tokens, according to Ripple. The company says the fix shipped in xrpld 3.4.1 on September 25 — before public disclosure — and investigators found no evidence that the vulnerability was exploited on a public network or that unauthorized XRP was issued.

The XRP Ledger is a decentralized blockchain whose native asset, XRP, has had a fixed supply since launch, meaning no transaction is permitted to create additional tokens. That is precisely what made the flaw notable: it represented a potential way around the ledger's most basic monetary.

The disclosure raised questions and some misconceptions, which the XRP Ledger Foundation addressed directly in a post on X:

The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let's clear them up.

1. Was any XRP created?

No. XRP's supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around…

— XRP Ledger Foundation (@XRPLF) October 11, 2026

The distinction matters: the bug threatened the ledger's supply rules, but the available evidence does not show that XRP's cap was actually breached.

J. Ayo Akinyele, RippleX's senior director of engineering, said, "The bug had existed in the codebase for over a decade and could have allowed XRP to be created beyond its fixed supply."

How Could a Payment Bug Threaten the XRP Supply?

The flaw sat in the payment engine, the component that calculates amounts when a transaction trades through offers on the XRP Ledger's built-in exchange. Under specially constructed conditions, arithmetic could overflow: instead of returning the true total owed across the offers, the calculation could wrap around and produce a much smaller number. Overflow bugs are a long-documented category of software defect, occurring when a calculation exceeds the largest value its numeric type can store.

That mismatch created the potential for sellers to receive more XRP than the buyer paid. The ledger's supply limit was set when all 100 billion XRP were created at inception; unlike proof-of-work networks, validators do not mine new XRP as they process transactions. A flaw that could make extra XRP spendable therefore struck at a basic monetary rule rather than at a single account.

RippleX said developers tested the patch and coordinated upgrades with network operators before the issue was publicly disclosed. Releasing the fix ahead of the announcement follows standard coordinated-disclosure practice, which gives operators time to upgrade before vulnerability details become widely known. The fix was included in xrpld 3.4.1, the server software that processes transactions and maintains ledger records. The XRP Ledger Foundation's vulnerability disclosure report details the payment-engine overflow and its remediation.

That rapid software rollout is distinct from the ledger's amendment process, which validators use to activate changes to protocol rules. Earlier XRPL amendment activations have shown how validator support can determine when a protocol change takes effect; the supply-flaw fix instead took effect simply as servers upgraded to the patched release.

What Does the Incident Mean for XRP Holders?

Akinyele outlined RippleX's response in a post on X on October 10:

Security remains our top priority for preserving trust in the XRP Ledger (XRPL). Sharing a few thoughts following yesterday's disclosure of the critical payments engine vulnerability reported by Veria AI.

First, this was a serious vulnerability, and we don't take that lightly.…

— J. Ayo Akinyele (@ja_akinyele) October 10, 2026

The documented risk was the possible creation of unauthorized, spendable XRP — not a confirmed loss of user funds. Investigators found no evidence of public-network exploitation, and the primary disclosure does not establish that any funds were lost. The correct reading is a serious vulnerability that was patched, not a confirmed supply breach.

The bug's age remains significant. A defect in a core payment path persisted in the codebase for more than a decade, while a safety check intended to guard against XRP creation failed to catch the same arithmetic problem. In trading terms, the vulnerability exposed a blind spot in a rule that should have acted like a circuit breaker.

XRP-related security incidents can also involve very different systems. A wallet or service compromise, for example, is not the same as a flaw in the ledger's transaction rules, as illustrated by the separate case of an XRP-related healthcare hack.

The vulnerability was reported by Veria AI, which helped uncover the issue through the XRPL bug bounty program, following disclosure on Friday, October 9. Bug bounty programs are a common mechanism across the blockchain industry for sourcing security review from outside researchers, who report flaws privately so fixes can ship first. Akinyele added, "AI is fundamentally changing how quickly vulnerabilities can be discovered."

Because the fix reached the network through a software release rather than a protocol amendment, the practical markers from here are operational: server operators adopting the patched xrpld 3.4.1 release, and any further technical detail in the Foundation's disclosure report.

Source: 99Bitcoins — A Decade-Old Ripple XRP Ledger Flaw Was Patched Before Disclosure