The XRP Ledger bug sat in the network’s payment engine for roughly a decade. A single crafted transaction could have created about 18 trillion XRP. That figure equals roughly 184 times the network’s 100 billion supply. However, RippleX says it found no evidence that anyone exploited the flaw on a public network. The fix shipped in xrpld 3.4.1 on September 25, and RippleX disclosed the details on October 9.
Our AI found a bug that let anyone mint infinite XRP, with $94B at risk. It had been hiding in one of the most audited codebases in crypto for nearly a decade, and earned us the maximum $250K bounty. Here’s how it went unnoticed, and how we found it. https://t.co/m7rSD8mKS5
— SuperBeetleGamer (@Cayden_Liao) October 11, 2026
How the Overflow Created XRP From Nothing
The flaw lived in the payment engine, which settles trades on the ledger’s decentralized exchange. When one payment fills many offers in the order book, the engine adds up the amounts involved. The code used unchecked 64-bit arithmetic for that sum. As a result, a large enough total could wrap around and return a tiny number. Sellers still received their full payout, while the buyer paid only the wrapped amount. The gap between the two figures became new XRP. Importantly, RippleX engineers reproduced the attack on a standalone server and confirmed that the new XRP stayed spendable in a later transaction.
The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let’s clear them up. 1. Was any XRP created? No. XRP’s supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around that rule, and 3.4.1 fixed it 2 weeks ago. You don’t need to trust us on this. All ledger data is public, and explorers and data sites read it every day. New XRP would show up in account balances for everyone to see. There is no hidden place for XRP on the XRP Ledger, every balance is public. We monitor the XRP Ledger 24/7 and have verified the supply throughout the history of the ledger. Others in the community verified this too, and anyone can do the same. Transaction fees are destroyed, so the supply is deflationary. About 99.986 billion XRP exist today. 2. How did this go unnoticed, and what’s next? No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations. AI makes bugs like this faster to find, for the bad guys and the good guys. Together with RippleX and the community, we will ensure the XRP Ledger is protected against such vulnerabilities. This means radically applying Formal Verification and AI adversarial testing, collaborating closely with security researchers, and strengthening the bug bounty program. You’ll hear a lot more about this as we progress. 3. XRP Ledger decentralization at the core of this. A public fix shows attackers where the bug is, and AI makes that fast. With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security. As a reaction to this, the XRPL community came together, and among them the XRP Ledger Foundation, RippleX, core devs and validators formed a social consensus and agreed on a path forward that involves shipping the fix directly. Patching a live network is never trivial, so the plan was also designed to minimize disruption for everyone running on it. We shared the build with the default UNL validators, using the contact details each one publishes in its xrp-ledger.toml file. Public binaries followed the same day, September 25. No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments. Big thanks to Cayden Liao and Veria AI for finding and reporting this responsibly, to the XRPL core developers for building and testing the fix, and to every node operator who upgraded so quickly, especially the validators. Full report: https://t.co/aWxdvthYPt
— XRP Ledger Foundation (@XRPLF) October 11, 2026
An AI Agent Finds What Audits Missed
Veria Labs pointed an AI agent at the rippled codebase, and the agent built a working exploit. The team demonstrated it on local networks and reported it through the XRPL bug bounty program on September 22. Initially, the submission carried a “Major” rating. RippleX reproduced the flaw the next day, raised the severity to critical, and merged a fix. Ripple then paid Veria $250,000, which reports describe as the largest known bounty for a bug an AI agent found on its own. Notably, CryptoSlate reports that the codebase had already passed more than a dozen security audits since 2024. RippleX head of engineering J. Ayo Akinyele said the case shows why longstanding assumptions deserve a fresh look.
Why RippleX Skipped the Amendment Vote
Protocol changes on the XRP Ledger normally travel through the amendment process. That process requires 80% validator support held across two weeks. A public amendment would also reveal the vulnerable code before most operators could protect themselves. Therefore RippleX shipped the fix as a direct code change in xrpld 3.4.1 and withheld the source until after deployment. More than 80% of validators on the default Unique Node List upgraded by September 25. That rapid uptake limited the risk of validators disagreeing over which software version to run. Afterward, the XRPL Operations account made 3.4.1 the minimum required version. The same release also fixed a separate Batch bug through the fixBatchV1_2 amendment, which activated on mainnet October 9.
XRP Ledger version 3.4.1 is now the minimum required version after the recent amendments were activated. This release patched critical parts of the XRP Ledger. The vulnerability report can be found here: https://t.co/sYIwuDomjY Public release notes: https://t.co/JqX4UYDDg6 https://t.co/pH9Gnsnpqi
— XRP Ledger Operations (@XRPLOperations) October 10, 2026
What the Disclosure Means for XRP Holders
XRP’s design depends on a fixed supply of 100 billion tokens, with transaction fees slowly reducing it. A successful exploit would have broken the monetary rule that gives the asset its scarcity. Meanwhile, RippleX reports that no unauthorized XRP appeared and no funds disappeared. The phrase “no evidence of exploitation” still falls short of absolute proof, so the ledger’s public history remains the best check. In contrast to many incidents, this one ended with a coordinated fix, quick validator adoption, and a public postmortem. Additionally, the episode shows that AI-driven auditing can now find chained flaws that human reviews missed for years.
*Disclaimer: News content provided by Genfinity is intended solely for informational purposes. While we strive to deliver accurate and up-to-date information, we do not offer financial or legal advice of any kind. Readers are encouraged to conduct their own research and consult with qualified professionals before making any financial or legal decisions. Genfinity disclaims any responsibility for actions taken based on the information presented in our articles. Our commitment is to share knowledge, foster discussion, and contribute to a better understanding of the topics covered in our articles. We advise our readers to exercise caution and diligence when seeking information or making decisions based on the content we provide.
