A vulnerability in the XRP Ledger's payment system could have allowed an attacker to create large amounts of new XRP without paying for it, breaking the token's fixed-supply rule, according to a security report published Friday.

The bug, believed to date back to 2015, was discovered by researcher Cayden Liao and Veria AI and internally reported on Sept. 22. Engineers at RippleX, Ripple's developer arm, reproduced the attack on a standalone server — an isolated test environment — and confirmed that the newly created XRP could be spent in a later transaction.

RippleX said it found no evidence the flaw was ever exploited on any public network. The company shipped a fix in xrpld 3.4.1, the ledger's server software, on Sept. 25, without publicly disclosing what the release repaired — a sequencing common in coordinated vulnerability disclosure, which gives operators time to update before technical details that could enable attacks become public. Details were later laid out in the team's official vulnerability disclosure report. Because the patch lives in the server software itself, its coverage across the network depends on operators adopting the updated release.

Researchers demonstrated how a single payment could create spendable XRP without the sender funding it, prompting the emergency software release. Had it gone unpatched, the flaw could have violated the cryptocurrency's fixed supply of 100 billion tokens.

A Direct Threat to the Supply Cap

All 100 billion XRP were created when the ledger launched in 2012, and its software is designed so that no more can ever be added. Because that scarcity is enforced entirely in code rather than by any issuing party, a bug capable of minting tokens would have struck at the ledger's most fundamental guarantee. The security vulnerability, however, could have allowed an attacker to create XRP from nothing and sell it on exchanges, undermining a hard supply cap that institutions building on the network rely on.

How the Attack Worked

The exploit targeted the ledger's built-in exchange, where accounts post offers to swap one token for another.

Theoretically, an attacker could open hundreds of accounts, have each one offer a tiny amount of a token in exchange for an unusually large amount of XRP, then send a single payment that bought every offer at once. The total XRP owed across those combined offers would be too large for the software to count correctly. As a result, the attacker's selling accounts would be paid in full while the buying account was charged almost nothing — leaving the attacker with XRP that had never existed before.

In effect, the vulnerability was a counting error in the built-in exchange, one that could have let hundreds of accounts receive large amounts of XRP while the buyer paid almost nothing.

Why Existing Safeguards Missed It

The XRP Ledger runs a check after every transaction to ensure that no new XRP has appeared, but that check would have relied on the same miscounted total and would have missed the discrepancy. A separate limit on how much XRP a single account can receive also would not have triggered, because the attack spread the newly created tokens across hundreds of accounts.

The researchers' method required only a few hundred XRP to open those accounts — most of which have been recovered afterward — plus standard transaction fees.

Part of a Broader Pattern

The incident joins a run of long-hidden crypto security flaws surfaced with the help of AI since July, including the Coldcard wallet bug behind the theft of at least 1,367 BTC and the vulnerabilities that forced Core Lightning to tell bitcoin node operators to disconnect.