Oct. 12 (CandyPulse) — For years, a flaw sat inside the XRP Ledger's payment engine that could, in theory, have made XRP out of thin air. Nobody is known to have used it. By the time the public heard about it, the hole was already closed.
RippleX disclosed the vulnerability on Oct. 9, 2026, two weeks after the fix shipped. The developer team said there is no evidence it was exploited on any public network. The flaw was an integer overflow, a decades-old class of software bug, and it was reported through the XRP Ledger bug bounty program by researcher Cayden Liao and Veria AI.
Key takeaways
xrpld is the server software that runs the XRP Ledger. It used to be called rippled. Reports say the bug dates back to around 2015, so it survived roughly a decade of the network's history without being noticed.
The easiest way to picture an integer overflow is an old car odometer. Picture a five-digit counter showing 99,999. Drive one more mile and it rolls over to 00,000. The dial no longer matches reality.
Computers store numbers in fixed-size slots too. This one was 64 bits. If a calculation pushes a value past what the slot can hold, it wraps around, and the program may carry on trusting a figure that is badly wrong. In a payment engine, that can mean money that shouldn't exist.
RippleX reproduced the attack on a standalone server, a private test instance cut off from the live network. They confirmed that the extra XRP it created could be spent in follow-up transactions.
That matters. A ledger is only worth something if its supply rules hold. XRP has a fixed cap, and a bug that can create coins past that cap goes after the one promise every holder is relying on.
Veria has described a far larger scenario. It says its demonstration could create about 18 trillion XRP, roughly 184 times the intended supply, and it framed about $94 billion of market value as at risk. Those are Veria's own figures. They don't appear in the official disclosure, and readers should treat them as one firm's worst-case model, not a measured loss. The same goes for Veria's claim of a $250,000 bounty payout, which it reported itself and which the official disclosure doesn't confirm.
The order of events can look odd: patch first, explain two weeks later. That is how responsible disclosure normally works.
Announcing a serious flaw before a fix is widely installed gives attackers a map. Quietly shipping the patch, waiting until most of the network has upgraded and only then publishing the details shrinks the window in which anyone could act on that information.
Some outlets reported that the patch was made on Oct. 9. The better-supported date is Sept. 25. Oct. 9 is when the disclosure was published.
| Date | Event |
|---|---|
| Around 2015 | Flaw enters the code, according to reports |
| Sept. 22, 2026 | Researcher reports the bug through the XRP Ledger bug bounty program |
| Sept. 25, 2026 | xrpld 3.4.1 ships; over 80% of default UNL validators run it the same day |
| Oct. 9, 2026 | Public disclosure; RippleX reports no evidence of exploitation |
| Oct. 9, 2026 | fixBatchV1_2 amendment, fixing a second, lower-severity bug, goes live on mainnet |
Three days separated the report and the patch. What came next mattered more.
The XRP Ledger reaches agreement through validators, and most nodes trust a default list of them called the Unique Node List, or UNL. More than 80% of validators on that default list were running xrpld 3.4.1 on the day it was released.
That's fast. On many networks, critical upgrades drag on for weeks. Here, most of the trusted validator set moved the same day, long before the public heard about the bug.
A second, lower-severity bug was also addressed. It involved how Batch transactions are wrapped, and its fix sits behind the fixBatchV1_2 amendment, which went live on mainnet on Oct. 9.
Veria AI's involvement drew as much attention as the bug did. Several reports framed the finding as a warning that AI-driven tools are getting better at uncovering exploitable flaws in old, heavily used code.
That cuts both ways. A bug that went unnoticed for around a decade was surfaced with machine help and reported through proper channels, which is the good outcome. But the same techniques are available to people who wouldn't file a bounty report. Projects with older codebases may need to assume hidden flaws will now be found faster.
If you simply hold XRP in a wallet or on an exchange, you don't need to do anything.
If you run an XRP Ledger node or validator, make sure you're on xrpld 3.4.1 or later. Versions 3.4.0 and earlier contain the overflow flaw.
The broader lesson: a blockchain's security rests on code people wrote, sometimes years ago, and on how fast its operators respond.
Expect closer scrutiny of the XRPL payment engine and of other long-lived code paths, particularly as AI-assisted auditing spreads. Observers will also watch whether remaining node operators finish upgrading and whether further details, including the final reward, are published.
For now, the record shows the bug was reported, reproduced, patched and widely deployed before the public knew it existed.
This article is for information only and is not financial advice. Scale and bounty figures attributed to Veria are self-reported and unverified.