XRP Devs Found The Infinite XRP Supply Bug Fix, But..

The XRP Ledger Foundation has issued a detailed clarification on a recent critical security fix, while on-chain investigator ZachXBT publicly criticized the size of the reward paid to the researchers who reported it.

What the Foundation said about it

According to the XRP Ledger Foundation, a critical vulnerability was discovered that could have allowed the creation of new XRP outside the ledger’s fixed-supply rules. The bug was patched in version 3.4.1 roughly two weeks ago.

The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let’s clear them up.

1. Was any XRP created?

No. XRP’s supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around…

— XRP Ledger Foundation (@XRPLF) October 11, 2026

Key points from the Foundation:

• No additional XRP was actually created. The total supply remains fixed at the original 100 billion, with roughly 99.986 billion XRP in existence today after transaction fees are burned.
• The exploit path required hundreds of deliberately constructed operations and was not reachable through normal payments.
• Because publishing a full public amendment process would have given potential attackers weeks of advance notice, the community (including the Foundation, RippleX, core developers, and validators) coordinated a direct software patch.
• Validators later formalized the change through a standard amendment vote that required more than 80% support for two weeks.
• Public binaries were released the same day the fix was shared with default UNL validators (September 25, 2026).

The Foundation credited researchers Cayden Liao and Veria AI for the responsible disclosure, along with core developers and node operators who upgraded quickly.

They also said future efforts will include stronger formal verification, AI adversarial testing, and an improved bug-bounty program.

The criticism over the bounty

ZachXBT took issue with the reported $250,000 payment to the whitehat researchers. In his view, paying that amount for a critical infinite-supply vulnerability — while the broader ecosystem holds substantial reserves — risks discouraging future good-faith reporting.

Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?

Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith.

This is why people do not take XRPL or Ripple…

— ZachXBT (@zachxbt) October 12, 2026

He argued that underpaying serious discoveries can push researchers toward more adversarial approaches and damages the perceived seriousness of the project.

The comment reflects a broader industry tension: how much critical infrastructure projects should pay for vulnerabilities that could have systemic consequences.

The balanced takeaway

On the technical side, the XRPL Foundation’s account is consistent and verifiable on a public ledger: no new XRP appears to have been minted, the fix is live, and the amendment process was still used to formalize the change. The decision to ship a direct patch first was framed as a security necessity rather than a bypass of decentralization principles.

Looking from a different perspective, the $250,000 figure has drawn criticism for appearing modest relative to the severity of an infinite-supply bug. Whether that amount is appropriate remains a judgment call, but the debate itself highlights an ongoing industry issue around properly compensating whitehat research on high-value networks.

The ledger’s fixed-supply rule held. The disclosure process and the size of the reward are now the main points of discussion.

Explore DailyCoin’s trending crypto news today:
HBAR’s $0.40 Falling Wedge Meets a 6-Year Compression
Cardano’s $20 Dream Resurfaces While CIP-0113 Goes Live