A security vulnerability in the XRP Ledger's payment software could have enabled attackers to create new XRP tokens, potentially undermining the network's fixed 100 billion token supply. The flaw likely existed undetected since 2015.
Researcher Cayden Liao and Veria AI discovered the integer-overflow bug and reported it through the XRPL Bug Bounty program on September 22, 2026. RippleX, Ripple's developer arm, stated it found no evidence the vulnerability was exploited.
How the Attack Would Work
The XRP Ledger includes a built-in marketplace where accounts can list trading offers between different tokens. According to the security report, an attacker could open hundreds of accounts, each offering a small amount of a token in exchange for a large amount of XRP.
A single payment could then execute all offers simultaneously. The payment engine's transaction counter would overflow and reset to a minimal value, similar to an odometer surpassing its maximum. This would allow selling accounts to receive full payment while the buyer paid almost nothing. A safety mechanism designed to detect newly created XRP relied on the same faulty counter, failing to catch the discrepancy.
Unprecedented Emergency Patch
Ripple released the fix in server software version 3.4.1 on September 25, 2026, bypassing the standard XRP Ledger governance process. Changes to transaction processing typically require approval from more than 80 percent of trusted validators for two weeks before implementation.
RippleX explained that a public vote would have exposed the bug in open code while it remained exploitable. More than 80 percent of default validators upgraded on release day, before the fix's code was made public.
RippleX stated this was the first time a transaction processing change had deliberately circumvented the amendment system since its introduction over a decade ago. The company said future changes will continue to follow the standard validator vote process, and that the XRPL Foundation, RippleX, and validators jointly decided on the emergency approach.
