A critical bug in the XRP Ledger sat undetected for more than a decade before researchers discovered it in September 2026. The integer-overflow flaw could have allowed an attacker to create billions of XRP tokens, undermining the blockchain's core mechanism that locks the total supply at 100 billion coins.
Researchers Cayden Liao and Veria AI reported the vulnerability on September 22. RippleX, which maintains the ledger, confirmed no evidence of exploitation or unauthorized XRP creation on the public network and deployed a patch shortly after.
How the Bug Worked
The flaw stemmed from an integer-overflow vulnerability, similar to an arcade game score counter resetting to zero after hitting its maximum value. In the XRP Ledger, once a transaction exceeded the system's maximum numerical limit, the value would wrap around to a very small number, bypassing standard fund checks.
An attacker could have set up dummy accounts to post fake token sales worth enormous amounts of XRP, then purchased all tokens at once. The ledger would credit seller accounts with billions of valid XRP while charging the buyer only a fraction of a cent, effectively minting the difference out of thin air and artificially inflating total supply.
Why It Remained Hidden
The bug went unnoticed primarily because triggering it required massive scale and deliberate construction. According to the XRP Ledger Foundation, normal payment activity never came close to triggering the flaw, and it would have taken hundreds of deliberately constructed operations to exploit.
The ledger's own safeguards also failed to catch the issue. The validation check that runs after each transaction to confirm no new XRP has been created relied on the same miscounted total, so it registered nothing unusual. A separate limit on how much XRP a single account can receive didn't trigger either, as the potential attack would have distributed XRP across hundreds of accounts.
The XRP Ledger Foundation noted that the vulnerability is believed to have existed since 2015. As of the discovery, approximately 99.986 billion XRP remained in circulation.
Future Security Measures
The foundation stated that artificial intelligence is accelerating the discovery of such flaws for both security researchers and potential attackers. To strengthen security going forward, the XRP Ledger Foundation plans to aggressively apply AI adversarial testing, implement formal verification, and strengthen its bug bounty program.
