The XRP Ledger has resolved a critical security flaw that could have allowed an attacker to create as many as 18 trillion XRP — a sum far beyond the network's fixed supply. Security researcher Cayden Liao, who discovered the decade-old bug, received a $250,000 bounty, and developers at RippleX and the XRP Ledger Foundation secured the network before publicly disclosing the vulnerability in an official disclosure report.

Overflow Bug Threatened XRP's Fixed Supply

The vulnerability sat in the ledger's payment engine and was an overflow bug — a common class of software defect in which a calculation exceeds the maximum value its data field can hold, producing unintended results. According to Liao, a specially crafted transaction could have produced spendable XRP beyond the fixed supply, placing the network's financial integrity at risk.

The XRP Ledger launched in 2012 with a cap of 100 billion XRP. Unlike many other cryptocurrencies, XRP cannot be mined or staked on the network, and small amounts are permanently destroyed with each transaction as fees — a dynamic that slowly reduces the number of XRP in circulation. The newly revealed flaw could have overridden this supply restriction.

Liao said his team developed a proof of concept capable of generating approximately 18 trillion XRP through a single transaction, roughly 184 times the network's initial supply. With XRP holding a market capitalization of around $94 billion, a successful exploit could have damaged trust in the asset and the wider market. Developers said, however, that no attacker has been found to have exploited the flaw on public networks.

Emergency Patch and Coordinated Disclosure

The vulnerability was reported through the XRPL bug bounty program on September 22, 2026. Developers released a patch on September 25 in xrpld version 3.4.1, and the disclosure states that more than 80% of default validators upgraded their software that same day.

Notably, the developers skipped the standard two-week validator amendment vote and instead followed an emergency process, which allowed them to address the threat without revealing technical details to the public. The approach reflects coordinated disclosure practice common across the software industry, in which fixes are shipped and deployed before details go public, shrinking the window in which potential attackers could act on the information. The coordinated disclosure followed on October 9, after the network had been secured. Liao publicized the finding and the reward in a post on X.

The episode also demonstrated that even extensively reviewed software can still contain serious weaknesses. The faulty code dated back to 2015, and the exploit relied on a combination of two bugs that individually may have appeared less threatening in earlier reviews — a pattern familiar in security research, where flaws that look minor in isolation can compound when combined. Liao's team earned the program's maximum $250,000 prize, with the researcher calling the discovery an "unusually significant security finding." The claimed proof of concept, however, was an attack demonstration rather than an exploit that inflicted actual damage.

No Evidence of Exploitation

Over the past few years, the XRP Ledger has been the subject of numerous audits security challenges, and the disclosure notes that the network has awarded more than $1 million in bug bounties. Such programs encourage researchers to report vulnerabilities responsibly instead of leaving them open to exploitation by attackers — an incentive model now common across the blockchain industry.

The incident serves as a reminder of the importance of timely software updates across blockchain networks. Validators are crucial because their software keeps the ledger functioning and secure, and prompt upgrades when critical vulnerabilities surface can minimize exposure. The day-one adoption of the September 25 patch by more than 80% of default validators showed that dynamic in action.

Despite the severity of the potential exploit, there were no reports of unauthorized XRP creation, and developers found no evidence that any users on public networks lost funds because of the flaw. A major theoretical threat was therefore eliminated without any incident on the public network.