TLDR
- XRP Ledger developers fixed a critical 2015 payment bug that could have created XRP beyond its 100 billion supply cap.
- Veria Labs said its AI agent found the flaw, and it earned the program’s top $250,000 bounty.
- Developers found no evidence the bug was exploited on any public network.
- RippleX skipped the usual validator vote and shipped the fix on Sept. 25.
- A separate Batch bug was also fixed, and both changes activated on Oct. 9.
XRP Ledger developers have fixed a critical bug that dated back to 2015. The flaw could have let an attacker create XRP beyond its 100 billion supply cap.
The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let’s clear them up.
1. Was any XRP created?
No. XRP’s supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around…
— XRP Ledger Foundation (@XRPLF) October 11, 2026
Developers said they found no evidence that anyone exploited the issue on a public network. The fix went out on Sept. 25.
How the bug worked
The problem sat in the payment engine. It added up XRP amounts from many order book offers, but the math had no overflow check.
A large enough total wrapped around to a small number. Sellers would still be paid in full, while the buyer paid only a few hundred drops plus the fee.
An attacker would have needed several hundred accounts and oddly priced offers. One payment would then consume them all, and the report said it could not be triggered by accident.
The supply check used the same kind of arithmetic, so it also failed to catch the extra XRP.
Who found it and how it was fixed
Veria Labs said its AI agent found the bug on Sept. 21 and built a working exploit on a test network. Co-founder Cayden Liao reported it on Sept. 22.
Liao said one transaction could have created about 18 trillion XRP. That is 184 times the token’s original supply.
Veria received the program’s top $250,000 bounty. Liao said it is the largest ever paid for a bug found entirely by an AI agent.
RippleX released xrpld version 3.4.1 on Sept. 25. More than 80% of validators on the default Unique Node List upgraded that day.
Normally, rule changes need support from more than 80% of trusted validators for two weeks. This fix skipped that vote and took effect as each server upgraded.
The report said waiting would have shown attackers where the bug was, since the software is open source. It called this a first in more than 10 years of amendments.
The source code was published about two weeks after the binaries. Cyber Capital founder Justin Bons criticized the delay on X.
RippleX engineer Mayukha Vadari replied that a critical patch cannot be hidden in a routine release anymore.
The update also fixed a separate bug in Batch, a feature that was not yet live. Batch and its fix activated on Oct. 9, and older servers can no longer stay in sync.
The XRPL Foundation said it will now retest previously reported security issues against release candidates before calling them fixed.
Be the first to comment