XRP Ledger patches decade-old bug that could break its supply cap

XRP Ledger developers patched a payment bug, buried in the code since 2015, that could have minted XRP far past the network's 100 billion cap. The fix shipped in September. The full account came out on October 9.

RippleX engineers rated the flaw critical. It sits in the payment engine, the part of the ledger that settles trades through its built-in exchange. In a disclosure report published on October 9, 2026, the team said it found "no evidence that this issue was exploited on any public network."

What the bug actually did

The flaw was an integer overflow. When a single payment filled many standing offers at once, the engine added up what each offer was owed. That total could grow too large for the software to count, so it wrapped around to a small number. The buyer paid almost nothing while the offer owners were credited in full. The difference showed up as fresh XRP that could then be spent. A built-in check meant to catch exactly this ran on the same flawed math, so it missed the problem too.

XRP runs on a fixed ceiling of 100 billion tokens, and no more are meant to exist. By Veria Labs' count, a single crafted transaction could have created about 18 trillion XRP, roughly 184 times that cap. The official report is more guarded, saying only that an attacker "could have created spendable XRP far beyond the total supply."

No XRP was minted. No funds moved. The versions at risk were xrpld 3.4.0 and earlier, and the repair went into xrpld 3.4.1, released on September 25, 2026.

A fix that skipped the usual vote

Changes to how the XRP Ledger processes transactions normally go through an amendment. A new rule stays switched off until more than 80 percent of trusted validators back it for two weeks. Validators are the servers that agree on the ledger's state, and the vote is meant to stop any single team from changing the rules alone. The process is slow by design. It gives operators time to object.

This fix did not wait. It shipped as a direct code change that took effect the moment each server upgraded to 3.4.1. RippleX said this was the first time a transaction-processing change had been pushed this way on purpose since the amendment system began. The source code was published only after the binaries were already running, about two weeks later.

Not everyone liked that order. Justin Bons, founder of Cyber Capital, criticized the stretch when the code stayed closed, arguing that shipping a patch before explaining it asks operators to trust software they cannot read. Mayukha Vadari, a RippleX engineer, defended the call. Publishing a working method for a bug that prints money, the argument goes, would have been worse than a short silence.

An AI agent found it, with help

The report credits Cayden Liao, security co-founder at Veria Labs, and the firm's AI agent with finding the overflow and building a working exploit. They filed it through the XRP Ledger bug bounty on September 22, 2026, and Veria took the program's top reward of $250,000.

Within days, RippleX engineers reproduced the attack on a test server, confirmed the minted XRP could be spent in a later transaction, and raised the severity from major to critical. By late September, more than 80 percent of validators on the default node list were already running 3.4.1, according to The Block.

Those headlines leaned hard on the AI angle. The reality is more human. A person pointed a tool at the code, read what it flagged, wrote it up, and sent it through a bounty program built for this. The bug had survived since 2015. It took ten years and a cash prize to surface it.

What to watch

Going forward, the XRP Ledger Foundation has set 3.4.1 as the minimum version operators should run. The same September release closed a second, lower-risk bug in the Batch feature, which bundles several transactions into one. That flaw came out of the Sherlock Attackathon, a public audit contest. J. Ayo Akinyele, RippleX head of engineering, said the team would lean more on AI-assisted bug hunting and formal checks after both finds.

XRP traded near $1.41 at 22:38 UTC on October 11, 2026, with a market value of about $88.9 billion, according to CoinGecko. The disclosure came without a sharp move in the price. The real test now is how fast validators and exchanges upgrade, and whether the next critical bug gets the same quiet handling or a noisier one.

For everyday holders, nothing needs doing. The risk lived in node software, not in wallets or private keys. The weak point now is any operator slow to upgrade. A node still running an old version would fall out of step with patched ones, which is the split the minimum-version rule is meant to stop.