Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
2 clusters · 43 sources · 3 days · First seen · Last updated
XRP Ledger security vulnerability and patch
Overview
A critical security vulnerability was identified in the XRP Ledger (XRPL) payment engine, which could have allowed an attacker to mint unauthorized XRP through a 64-bit integer overflow error. Researchers Cayden Liao and Veria AI discovered the flaw via the XRPL Bug Bounty program, noting that it could have theoretically enabled the creation of up to 18 trillion XRP in a single transaction—over 184 times the network’s fixed 100 billion supply. The flaw reportedly existed since 2015.
In response, the RippleX development team released an emergency patch (xrpld 3.4.1) on September 25, 2026. This deployment was notable as the first time in the network’s history that developers bypassed the standard two-week validator voting process to implement a fix immediately. The XRP Ledger Foundation and RippleX defended this unprecedented move, stating that following the standard amendment process would have made the vulnerability public weeks before a fix could be implemented, creating an “unacceptable security risk.”
While the decision to bypass standard processes sparked debate regarding decentralization—with critics like Justin Bons questioning the governance model—the XRP Ledger Foundation and RippleX have confirmed that the network’s fixed maximum supply remains intact. There is no evidence the vulnerability was ever exploited on the public network, with the total supply remaining secure at approximately 99.986 billion tokens. Following the incident, the Foundation has committed to enhancing security through increased AI-based testing and formal verification.
Entities
Cayden Liao · RippleX · Veria AI · XRP Ledger · XRP Ledger Foundation
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 17 SOURCES] A vulnerability in the XRP Ledger payment engine existed since 2015.
- [● 10 SOURCES] Veria Labs and researcher Cayden Liao discovered the vulnerability.
- [● 10 SOURCES] The vulnerability was caused by an integer overflow in the payment engine.
- [● 9 SOURCES] There is no evidence the vulnerability was exploited on a public network.
- [● 8 SOURCES] The emergency patch was released on September 25.
- [● 7 SOURCES] The vulnerability could have allowed the creation of approximately 18 trillion XRP.
- [● 6 SOURCES] Veria Labs received a $250,000 reward for reporting the bug.
- [● 6 SOURCES] The emergency patch bypassed the standard two-week validator amendment process.
Timeline
-
[TECHNOLOGY] 25 sourcesXRP Ledger fixes critical 2015 vulnerability
XRP Ledger developers issued an emergency patch to fix a 2015 integer overflow bug that could have allowed the creation of 18 trillion XRP. The fix bypassed standard voting to prevent potential exploitation.
-
[TECHNOLOGY] 23 sourcesXRP Ledger patches critical vulnerability that could have enabled unauthorized XRP minting
XRP Ledger developers patched a critical, decade-old integer overflow bug that could have allowed attackers to mint trillions of unauthorized XRP. No exploitation on the public network was detected.
Sources
ambcrypto.com · bitcoinbasis.de · bittimes.net · blockchainreporter.net · blockchainseoul.kr · blockmedia.co.kr · blocktempo.com · blogs.airdropalert.com · blogtienao.com · coin-turk.com · coincu.com · coindeskjapan.com · coinpedia.org · cointelegraph.com · criptoinforme.com · criptotendencia.com · crypto-insiders.nl · crypto.news · cryptobreaking.com · cryptobriefing.com · cryptonewsland.com · cryptoslate.com · cybernoz.com · en.bitcoinsistemi.com · ethnews.com · gizmodo.com · ilfaroonline.it · it-boltwise.de · livebitcoinnews.com · merca2.es · news.bitcoin.com · news.trijo.co · newsbit.nl · ontheissuesmagazine.com · phocapblockchain.net · sondakika.com · spacemoney.com.br · timestabloid.com · tokenpost.com · u.today · venceremos.it · zombit.info · zycrypto.com
This summary has been updated 6 times: see revision history