A decade-old flaw in the Ripple XRP Ledger payment engine could theoretically have let attackers create spendable XRP beyond the network’s fixed 100 billion supply cap.
Ripple says the fix shipped in xrpld 3.4.1 on September 25, before public disclosure, and investigators found no evidence that the vulnerability was exploited on a public network or that unauthorized XRP was issued.
The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let’s clear them up.
1. Was any XRP created?
No. XRP’s supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around…
— XRP Ledger Foundation (@XRPLF) October 11, 2026
That distinction matters: the bug threatened the ledger’s supply rules, but the available evidence does not show that XRP’s cap was actually breached.
J. Ayo Akinyele, RippleX’s senior director of engineering, said, “The bug had existed in the codebase for over a decade and could have allowed XRP to be created beyond its fixed supply.”
How Could a Payment Bug Threaten the Ripple XRP Supply?
The flaw sat in the payment engine, which calculates amounts when a transaction trades through offers on the XRP Ledger’s built-in exchange. Under specially constructed conditions, arithmetic could overflow: instead of returning the true total owed across the offers, the calculation could wrap around and produce a much smaller number.
That mismatch created the potential for sellers to receive more XRP than the buyer paid. The ledger’s supply limit was set when all 100 billion XRP were created at inception; unlike proof-of-work networks, validators don’t mine new XRP as they process transactions. A flaw that could make extra XRP spendable therefore struck at a basic monetary rule, not simply at an individual account.
RippleX said developers tested the patch and coordinated upgrades with operators before publicly disclosing it. The fix was included in xrpld 3.4.1, the server software that processes transactions and maintains ledger records. The XRP Ledger Foundation’s vulnerability disclosure report details the payment-engine overflow and its remediation.
That rapid software rollout is distinct from the ledger’s amendment process, which validators use to activate changes to protocol rules. Earlier XRPL amendment activation illustrates how validator support can determine when a protocol change takes effect; the supply-flaw fix instead took effect as servers upgraded to the patched release.
EXCLUSIVE: Earn $50 With EdgeX and Enter $300K Prize Draw
What Does the Incident Mean for XRP Holders?
Security remains our top priority for preserving trust in the XRP Ledger (XRPL). Sharing a few thoughts following yesterday’s disclosure of the critical payments engine vulnerability reported by Veria AI.
First, this was a serious vulnerability, and we don’t take that lightly.…
— J. Ayo Akinyele (@ja_akinyele) October 10, 2026
The documented risk was the possible creation of unauthorized, spendable XRP-not a confirmed loss of user funds. Investigators found no evidence of public-network exploitation, and the primary disclosure does not establish that funds were lost. The correct reading is a serious vulnerability that was patched, not a confirmed supply breach.
The bug’s age is still significant. A defect in a core payment path remained in the codebase for more than a decade, while a safety check intended to guard against XRP creation failed to catch the same arithmetic problem. In trading terms, the vulnerability exposed a blind spot in a rule that should have acted like a circuit breaker.
XRP-related security incidents can involve very different systems: a wallet or service compromise, for example, is not the same as a flaw in the ledger’s transaction rules, as the distinction around an XRP-related healthcare hack makes clear.
RippleX executive J. Ayo Akinyele outlined the response on X on October 10, after disclosure on Friday, October 9. Veria AI helped uncover the issue through the XRPL bug bounty program. Akinyele said, “AI is fundamentally changing how quickly vulnerabilities can be discovered.”
DISCOVER: 15+ Upcoming Coinbase Listings to Watch in 2026
Follow 99Bitcoins on X For the Latest Market Updates and Subscribe on YouTube For Daily Expert Market Analysis.
Why you can trust 99Bitcoins
Established in 2013, 99Bitcoin’s team members have been crypto experts since Bitcoin’s Early days.
90hr+
Weekly Research
100k+
Monthly readers
50+
Expert contributors
2000+
Crypto Projects Reviewed
Follow 99Bitcoins on your Google News Feed
Get the latest updates, trends, and insights delivered straight to your fingertips. Subscribe now!
