A hidden bug could have created XRP from nothing
The XRP Ledger carried a critical payment flaw for about a decade. Validators patched it before disclosure, and RippleX says it found no evidence of public exploitation.
Article
For about a decade, one carefully constructed XRP Ledger payment could have created spendable XRP that nobody paid for.
The flaw was real. RippleX reproduced it, confirmed the newly created XRP could be spent and classified it as critical.
The exploit was also patched before the public learned how it worked. RippleX says it found no evidence that anyone used it on a public network.
That makes this a story about the fixed supply nearly failing, not about new XRP entering circulation.
How one payment could break the supply rule
An attacker would first create hundreds of accounts and place deliberately absurd offers on the ledger’s order book. Each offer would sell a tiny amount of another token for a huge amount of XRP.
One payment would then consume all of those offers.
The payment engine added the XRP totals using a 64-bit number. When the total became too large, it wrapped around to a tiny value. Each offer owner still received the full amount, while the buyer was charged only the wrapped total.
The difference was newly created XRP.
The ledger’s safety check should have stopped it. It did not, because that check added the balance changes using the same kind of arithmetic and could wrap around too.
Why nobody stumbled into it
Normal payments cannot reach the numbers required to trigger the flaw. The entire XRP supply is far below the overflow point.
The attack needed hundreds of artificial offers at prices no real trader would accept, followed by a payment designed to consume all of them at once. RippleX says the setup required only a few hundred XRP in recoverable reserves and ordinary transaction fees.
That made the bug cheap to exploit once understood, but almost impossible to hit by accident.
Validators patched it before disclosure
The fix shipped in xrpld 3.4.1 on September 25. It stops a payment when the running total would overflow. The independent no-mint check now uses a wider counter as a second line of defense.
RippleX says more than 80% of validators on the default trusted list upgraded on release day.
The team made an unusual decision: it did not wait for the normal amendment process. Publishing an amendment would have exposed the vulnerable code path while the old rule remained active for weeks. Instead, each validator became protected as soon as it upgraded.
That created a short mixed-version risk. An attempted exploit during the transition could have made old and new servers disagree. RippleX judged that risk safer than leaving a public minting path open.
What XRP holders should take from this
There is no reported change to XRP’s circulating supply from this flaw. The useful questions now are about protocol risk:
- Are all remaining operators running 3.4.1 or newer?
- Has a forensic review of historical ledgers found any suspicious pattern?
- Will the new release process catch old security fixes that were incomplete?
The patch protected the ledger. The disclosure still matters because a rule as fundamental as fixed supply depended on two checks that could fail in the same way.
Sources and reporting notes
Checked October 11, 2026. The exploit path, local reproduction, mitigation, validator-upgrade figure and no-exploitation statement come from RippleX’s vulnerability disclosure. CoinDesk provided secondary context. We did not reproduce the exploit or independently audit historical ledgers.