A vulnerability that had existed in the XRP Ledger for roughly a decade could have allowed attackers to create spendable XRP without paying for it, putting the cryptocurrency's fixed supply of 100 billion tokens at risk. That cap is foundational to the asset: all 100 billion XRP existed from the ledger's launch, and the protocol's rules are built to move tokens between holders rather than mint new ones. Ripple's development team shipped an emergency software update to eliminate the flaw, and researchers found no evidence that it had ever been exploited on public networks.

The bug was disclosed on October 9, 2026, and reportedly traces back to 2015. Researchers Cayden Liao and Veria AI uncovered the issue through the XRP Ledger's bug bounty program and reported it on September 22. Programs like this are a mainstay of cryptocurrency security, giving outside researchers a private channel to deliver flaws to developers before details become public. RippleX, Ripple's developer division, reproduced the attack and confirmed that any newly created XRP could be spent in subsequent transactions.

How the XRP Supply Bug Worked

At its core, the flaw was an integer overflow in the XRP Ledger's payment engine — a classic software defect in which a calculation outgrows the fixed size of the number storing it. The ledger processes transactions through its built-in exchange, where users place offers to trade one asset for another.

An attacker could have taken advantage of this mechanism by creating hundreds of accounts and placing offers involving unusually large amounts of XRP. A single, carefully constructed payment could then consume all of those offers at once.

When tallying the total XRP owed across the consumed offers, the payment engine's numerical counter could be pushed past the maximum value it could represent, causing the total to wrap around to a much smaller number. As a result, the selling accounts would receive their full payments while the buyer paid only the incorrectly calculated amount — a discrepancy that would effectively create new XRP.

The ledger's existing safeguard intended to detect unauthorized XRP creation, relied on calculations vulnerable to the same overflow and could therefore fail to flag the newly created tokens. RippleX confirmed that mounting the attack would have required only a few hundred XRP to establish the necessary accounts, along with transaction fees.

Emergency Fix Bypassed the Usual Voting Process

Ripple released XRP Ledger server software version 3.4.1 on September 25 to address the vulnerability. Unlike conventional protocol changes, the payment-engine fix took effect as individual operators upgraded their servers. The official disclosure was published on the XRP Ledger blog at arriving about two weeks after the release — a gap consistent with coordinated disclosure norms, under which fixes ship first so operators can protect their systems before attack details go public.

The move marked an exceptional departure from the ledger's standard amendment process, which typically requires more than 80% support from trusted validators sustained over two weeks — a mechanism designed so that no single party can unilaterally rewrite the ledger's rules. RippleX explained that following the normal process could have publicly exposed the vulnerability while the network remained at risk during the voting and activation period. According to the official disclosure, more than 80% of default trusted validators had upgraded on the release day itself.

The vulnerability report, published October 9, confirmed that investigators found no evidence of exploitation on public networks. The incident underscores the value of independent security research and rapid coordination across cryptocurrency infrastructure. It also fits a familiar industry pattern: in 2018, Bitcoin Core developers quietly patched a consensus bug that could have allowed a miner to inflate Bitcoin's supply.

While Ripple contained the immediate threat, the episode raises broader questions about how decentralized networks should balance emergency security measures with transparent governance. RippleX emphasized that the exceptional response does not change the ledger's established approach to future protocol amendments.