started · updated
XRP Ledger patches critical vulnerability that could have enabled unauthorized XRP minting
The XRP Ledger (XRPL) development team, RippleX, has patched a critical security vulnerability in the network’s payment engine that could have allowed an attacker to mint unauthorized XRP. The flaw, which researchers believe has existed since 2015, was identified on September 22, 2026, by Cayden Liao and Veria AI through the XRPL Bug Bounty program.
The vulnerability stemmed from a 64-bit integer overflow error. When a single payment processed multiple offers from the ledger’s order book, the system failed to check if the total sum exceeded the maximum value. This allowed an attacker to create a massive discrepancy where sellers received full payments while the buyer was charged only a tiny fraction, effectively minting new XRP. In testing, the flaw could have enabled the creation of up to 18 trillion XRP in a single transaction—roughly 184 times the network's 100 billion token supply cap.
To address the threat, developers released an emergency patch (xrpld 3.4.1) on September 25, 2026. Notably, the team bypassed the standard two-week validator voting process to deploy the fix immediately, a first in the network's history, to prevent potential exploitation while the code was public. RippleX confirmed there is no evidence the vulnerability was ever exploited on the public network.
Entities
Cayden Liao · Ripple · RippleX · Veria AI · XRP · XRP Ledger
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] The bug had existed in the payment engine since its development in 2015. bittimes.net · news.bitcoin.com
- [● 2 SOURCES] A second vulnerability in the Batch transaction function was also identified and patched. bittimes.net · sotutto.it
- [● 18 SOURCES] The flaw was caused by an integer overflow in the 64-bit arithmetic used by the payment engine to sum multiple order book offers. bittimes.net · cryptobriefing.com · news.bitcoin.com · blockchainreporter.net · www.nadanews.com · +12 more
- [● 19 SOURCES] There is no evidence that the vulnerability was ever exploited on the public network. bittimes.net · cryptobriefing.com · news.bitcoin.com · blockchainreporter.net · www.nadanews.com · +13 more
- [● 16 SOURCES] The XRP Ledger development team patched a critical vulnerability that could have allowed the unauthorized creation of XRP. bittimes.net · cryptobriefing.com · news.bitcoin.com · blockchainreporter.net · www.nadanews.com · +10 more
- [● 9 SOURCES] The team bypassed the standard two-week validator voting process to deploy the emergency fix immediately. bittimes.net · cryptobriefing.com · news.bitcoin.com · www.nadanews.com · criptoinforme.com · +3 more
- [● 4 SOURCES] An exploit would have required only a few hundred XRP in reserves and transaction fees to execute. bittimes.net · cryptobriefing.com · news.bitcoin.com · cryptoslate.com
- [● 10 SOURCES] The bug could have enabled the creation of XRP exceeding the network's 100 billion token supply cap in a single transaction. cryptobriefing.com · news.bitcoin.com · bittimes.net · blockchainreporter.net · www.nadanews.com · +4 more
- [● 9 SOURCES] RippleX reproduced the attack on a standalone server and confirmed the excess XRP could be spent. www.spacemoney.com.br · cryptobriefing.com · news.bitcoin.com · bittimes.net · blockchainreporter.net · +3 more
- [● 4 SOURCES] There is no evidence that the vulnerability was ever exploited on a public network. bittimes.net · cryptobriefing.com · news.bitcoin.com
- [● 14 SOURCES] Cayden Liao and Veria AI reported the vulnerability through the XRPL Bug Bounty program on September 22, 2026. cryptobriefing.com · news.bitcoin.com · bittimes.net · blockchainreporter.net · www.nadanews.com · +8 more
- [● 11 SOURCES] The vulnerability existed in the payment engine since its development in 2015. bittimes.net · cryptobriefing.com · news.bitcoin.com · blockchainseoul.kr · blogtienao.com · +5 more