A security flaw dating back to 2015 in the XRP Ledger could have allowed attackers to create large amounts of XRP without paying for it, potentially breaking the network’s fixed supply of 100 billion tokens.

Researcher Cayden Liao, working with Veria AI, discovered the vulnerability and privately reported it to Ripple’s developer team on Sept. 22, 2026. RippleX engineers recreated the attack on a private test server and confirmed that an attacker could generate new XRP and later spend it as if it were legitimate tokens.

Ripple said it found no evidence that the method had ever been used on the public network. Developers addressed the issue in the xrpld 3.4.1 software update released on Sept. 25, although the update did not publicly explain the vulnerability at the time. The quiet patch follows the standard responsible disclosure pattern, in which researchers report flaws privately so maintainers can ship a fix before technical details become public. As with ledger software generally, the repair takes full effect as validators and node operators upgrade to the patched release.

The disclosure followed a Coin Bureau post on X:

⚡️GOOD NEWS: XRP Ledger patches a DECADE-OLD security flaw that could have created BILLIONS of dollars worth of XRP out of thin air. The bug, dating back to 2015, could have allowed attackers to generate and spend $XRP without funding it, potentially breaking the token's fixed… pic.twitter.com/06X2rrPRHE — Coin Bureau (@coinbureau) October 10, 2026

How the vulnerability worked

All 100 billion XRP were created when the ledger launched in 2012, and the software was designed to prevent additional coins from being issued. The vulnerability involved the XRP Ledger’s built-in exchange system, where users post offers to trade one token for another.

An attacker could have opened hundreds of small accounts. Each account could then offer a small amount of one token in exchange for a very large amount of XRP. By sending a single payment that filled all of the offers simultaneously, the attacker could make the total amount of XRP owed exceed what the system could calculate correctly.

Under those conditions, the accounts selling the tokens would be paid in full, while the account making the purchase would be charged almost nothing. The result would be newly created XRP appearing without a corresponding cost to the attacker.

A built-in safeguard intended to detect the creation of new XRP failed because it relied on the same calculation. A separate limit on the amount of XRP that one account could receive also did not prevent the exploit, because the attacker could distribute the tokens among multiple accounts.

Executing the attack would have required only a small amount of XRP to create the accounts, along with standard transaction fees — a cost low enough that the exploit’s feasibility depended on the software flaw itself rather than on significant capital.

XRPL software update and Batch feature

The vulnerability was one of several older cryptocurrency bugs identified this year with assistance from AI tools, following similar discoveries involving the Coldcard wallet and Core Lightning software. In each case, the flaws had gone unnoticed in widely used systems for years before AI-assisted review brought them to light.

Separately, the XRP Ledger activated a feature called Batch on its main network. Batch allows users to combine between two and eight transactions into a single action. Thirty of the network’s 35 validators approved the change, meeting the required two-week supermajority for activation.

The feature includes four settings. One setting requires every transaction in a batch to succeed; if any included transaction fails, the entire group fails. That all-or-nothing mode is aimed at a common failure in multi-step trades, where one leg executing without the other can leave a trader with an unexpected position. Supporters say Batch could be useful for trades, settlements and non-fungible token swaps that require multiple steps to occur together. The XRP Ledger’s Batch documentation is available at

In a related development, XRP-linked company Evernorth is preparing to list on the Nasdaq stock exchange under the ticker XRPN. The company said its listing date was moved from Oct. 8 to Oct. 12 because of an administrative delay. For readers tracking XRP-linked public companies, the rescheduled debut and the size of the company’s planned holdings are the near-term items to watch.

According to filings with the Securities and Exchange Commission, Evernorth expects to hold approximately 473 million XRP once the listing is complete.

Original report: https://coincentral.com/xrp-ledger-fixes-old-bug-that-could-have-created-billions-in-fake-tokens/