[CLSTR]
< Back to situation

[REVISION HISTORY]

XRP Ledger security vulnerability and patch

Updated 6 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-13 21:33 UTC → 2026-10-13 21:33 UTC · added removed

A critical security vulnerability was identified in the XRP Ledger (XRPL) payment engine, which could have allowed an attacker to mint unauthorized XRP through a 64-bit integer overflow error. Researchers Cayden Liao and Veria AI discovered the flaw via the XRPL Bug Bounty program, noting that it could have theoretically enabled the creation of up to 18 trillion XRP in a single transaction—over 184 times the network’s fixed 100 billion supply. The flaw reportedly existed since 2015. In response, the RippleX development team released an emergency patch (xrpld 3.4.1) on September 25, 2026. This deployment was notable as the first time in the network’s history that developers bypassed the standard two-week validator voting process to implement a fix immediately. Veria Labs utilized an AI-driven security agent to identify the flaw, The XRP Ledger Foundation and RippleX defended this unprecedented move, stating that following the researchers received a $250,000 reward, which is noted as standard amendment process would have made the highest ever for a vulnerability discovered entirely by AI. The public weeks before a fix could be implemented, creating an “unacceptable security risk.” While the decision to bypass standard processes sparked debate regarding decentralization—with critics like Justin Bons questioning the governance model—the XRP Ledger Foundation and RippleX have confirmed that the network’s fixed maximum supply of 100 billion tokens remains intact and that no unauthorized issuance occurred. They stated there intact. There is no evidence the vulnerability was ever exploited on the public network, noting with the total supply remains remaining secure at approximately 99.986 billion tokens. The vulnerability could have been executed by using hundreds of accounts to place simultaneous trading offers that would cause Following the system to miscalculate totals due to incident, the overflow. The decision to bypass standard amendment processes Foundation has sparked debate regarding the network’s decentralization. Critics, such as Cyber Capital founder Justin Bons, argued that withholding source code and pressuring operators committed to upgrade contradicts claims of a fully decentralized blockchain. enhancing security through increased AI-based testing and formal verification.

Versions

  1. 2026-10-13 21:33 UTC XRP Ledger security vulnerability and patch
  2. 2026-10-13 21:33 UTC XRP Ledger security vulnerability and patch
  3. 2026-10-12 21:50 UTC XRP Ledger security vulnerability and patch
  4. 2026-10-12 15:35 UTC XRP Ledger security vulnerability and patch
  5. 2026-10-12 15:35 UTC XRP Ledger security vulnerability and patch
  6. 2026-10-12 05:34 UTC XRP Ledger security vulnerability and patch
  7. 2026-10-12 02:05 UTC XRP Ledger security vulnerability and patch

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.