Researchers uncovered a critical bug in the XRP Ledger's payment engine that remained undetected for over a decade. If exploited, the flaw could have silently minted billions of XRP, compromising the ledger's fixed supply of 100 billion tokens.
Cayden Liao and Veria AI discovered the vulnerability and reported it through the XRPL Bug Bounty program on September 22, 2026. The flaw involved an integer overflow in the way the payment engine summed XRP amounts across offers on the built-in decentralized exchange.
How the Attack Would Have Worked
An attacker could open hundreds of accounts and place mispriced offers—small amounts of a token in exchange for large amounts of XRP. By crafting a payment that consumed all those offers simultaneously, the 64-bit counter would overflow and wrap around. Seller accounts would receive their full XRP while the buyer would be charged almost nothing.
The ledger's own verification mechanism, designed to enforce the "no XRP created" invariant, relied on the same flawed arithmetic and would have missed the overflow entirely. The attack would have cost only a few hundred XRP in reserves, most of it recoverable, plus transaction fees.
Emergency Response and Disclosure
RippleX reproduced the exploit on a standalone server and confirmed the flaw produced spendable tokens. The team released an emergency fix in xrpld 3.4.1 on September 25 without initially disclosing the vulnerability. Over 80 percent of default UNL validators were already running the patched version by release day.
Public disclosure followed on October 9, 2026. RippleX confirmed there is no evidence the flaw was ever exploited on any public network, with normal transaction activity never reaching the arithmetic limits that would trigger the vulnerability.
Implications for Institutional Adoption
The discovery and rapid patching come as the XRP Ledger advances institutional adoption. The Batch amendment recently went live, enabling atomic multi-transaction settlement. Evernorth's 473 million XRP treasury deal is advancing toward a Nasdaq listing, and Ripple Prime has launched stock trading through its Delta One business.
The fixed supply of 100 billion XRP, all minted at launch in 2012, serves as a core trust anchor for large capital. The rapid discovery, emergency patch, and transparent post-incident disclosure demonstrate the operational maturity institutions require for custody and settlement infrastructure.
