# XRP Ledger security vulnerability and patch

> Live situation record from CLSTR: https://clstr.news/situations/xrp-ledger-security-vulnerability-and-patch
> Updated: 2026-10-12T00:27:55.000Z. Sources: 43. Developments: 2.

A critical security vulnerability was identified in the XRP Ledger (XRPL) payment engine, which could have allowed an attacker to mint unauthorized XRP through a 64-bit integer overflow error. Researchers Cayden Liao and Veria AI discovered the flaw via the XRPL Bug Bounty program, noting that it could have theoretically enabled the creation of up to 18 trillion XRP in a single transaction—over 184 times the network’s fixed 100 billion supply. The flaw reportedly existed since 2015.

In response, the RippleX development team released an emergency patch (xrpld 3.4.1) on September 25, 2026. This deployment was notable as the first time in the network’s history that developers bypassed the standard two-week validator voting process to implement a fix immediately. The XRP Ledger Foundation and RippleX defended this unprecedented move, stating that following the standard amendment process would have made the vulnerability public weeks before a fix could be implemented, creating an “unacceptable security risk.”

While the decision to bypass standard processes sparked debate regarding decentralization—with critics like Justin Bons questioning the governance model—the XRP Ledger Foundation and RippleX have confirmed that the network’s fixed maximum supply remains intact. There is no evidence the vulnerability was ever exploited on the public network, with the total supply remaining secure at approximately 99.986 billion tokens. Following the incident, the Foundation has committed to enhancing security through increased AI-based testing and formal verification.

## Claims

- A vulnerability in the XRP Ledger payment engine existed since 2015. (corroborated by 17 sources)
- Veria Labs and researcher Cayden Liao discovered the vulnerability. (corroborated by 10 sources)
- The vulnerability was caused by an integer overflow in the payment engine. (corroborated by 10 sources)
- There is no evidence the vulnerability was exploited on a public network. (corroborated by 9 sources)
- The emergency patch was released on September 25. (corroborated by 8 sources)
- The vulnerability could have allowed the creation of approximately 18 trillion XRP. (corroborated by 7 sources)
- Veria Labs received a $250,000 reward for reporting the bug. (corroborated by 6 sources)
- The emergency patch bypassed the standard two-week validator amendment process. (corroborated by 6 sources)

## Timeline

### 2026-10-12: XRP Ledger fixes critical 2015 vulnerability

XRP Ledger developers issued an emergency patch to fix a 2015 integer overflow bug that could have allowed the creation of 18 trillion XRP. The fix bypassed standard voting to prevent potential exploitation.

25 sources. https://clstr.news/cluster/xrp-ledger-foundation-confirms-no-new-xrp-created-after-emergency-patch

### 2026-10-09: XRP Ledger patches critical vulnerability that could have enabled unauthorized XRP minting

XRP Ledger developers patched a critical, decade-old integer overflow bug that could have allowed attackers to mint trillions of unauthorized XRP. No exploitation on the public network was detected.

23 sources. https://clstr.news/cluster/xrp-ledger-fixes-critical-bug-that-allowed-infinite-xrp-minting

---
Cite as: XRP Ledger security vulnerability and patch. CLSTR, https://clstr.news/situations/xrp-ledger-security-vulnerability-and-patch