Developers behind the XRP Ledger have disclosed and fixed a critical vulnerability that, left unaddressed, could have allowed an attacker to conjure XRP out of thin air—a flaw that sat dormant in the network's code for roughly a decade.

In a disclosure published Friday, the ledger's maintainers said a researcher reported the bug through the XRPL bug bounty program in September. The issue was an integer overflow in the payment engine, the component of the software responsible for processing payments.

The arithmetic failure surfaced only under unusual conditions. When a single payment consumed hundreds of specially crafted offers from the order book, the sum of what the buyer owed exceeded the maximum value the system could store and "wrapped around" to a tiny number. The engine paid each seller in full but charged the buyer almost nothing, with the difference amounting to newly minted XRP that should never have existed.

Compounding the problem, the ledger's built-in safety check—designed to confirm that no transaction creates XRP—relied on the same flawed arithmetic. It wrapped around identically and caught nothing. According to the maintainers, an attacker could have created spendable XRP far beyond the token's total supply in a single transaction, then moved it, traded it, or sent it to exchanges. That check is the mechanism the ledger relies on to guarantee that no transaction can mint new XRP, and it failed silently alongside the very code it was meant to police.

RippleX engineers confirmed the bug had been present since the current payment engine was written in 2015. It went unnoticed because no ordinary payment comes anywhere near triggering the overflow, and there is no evidence it was ever exploited, the team said.

The fix shipped in version 3.4.1 on Sept. 25, and more than 80% of the network's trusted validators were running it that same day. Notably, the patch bypassed the ledger's usual amendment process, which requires validators to vote and wait two weeks before a change takes effect. It marked the first time a transaction-processing change has deliberately shipped that way since the system was introduced more than a decade ago. The maintainers said the severity justified the deviation, since publishing the open-source fix would have revealed the bug while leaving it exploitable for weeks. With the flaw now public, any validator still on an earlier release has both the reason and the remedy at hand—upgrading to 3.4.1 removes the flawed arithmetic from that node's payment processing.

The disclosure echoes a counterfeiting scare that rocked Zcash earlier this year, when the privacy coin raced to patch a soundness bug in its shielded pool that could have allowed forged coins. That episode sent ZEC tumbling before the network's Ironwood upgrade resolved it. Both incidents targeted the same class of assurance: that a blockchain's asset cannot be manufactured out of thin air, no matter how cleverly a transaction is crafted.

XRP didn't escape the week unscathed. The token traded at $1.38 on Monday, down 1.6% over 24 hours—the worst performance among major cryptocurrencies—and off 9.4% over the past seven days.