XRP Ledger Bug Could Have Created 18 Trillion XRP Before Fix

• Developers found no evidence of exploitation on public networks.
• Veria estimated the flaw could create 18.45 trillion XRP per transaction.
• The emergency patch sparked debate over temporarily withheld source code.

An XRP Ledger security bug could have allowed attackers to create trillions of spendable tokens, developers disclosed on October 9. The flaw dated to 2015 and was patched on September 25. Developers found no evidence of public exploitation. The XRP Ledger Foundation also said on X that checks confirmed the public supply remained intact.

How the XRP Ledger security bug bypassed supply checks

Veria reported the flaw on September 22. RippleX reproduced the XRP Ledger security bug on a standalone server, confirming that newly created tokens could fund another payment.

He estimated potential creation at about 18.45 trillion XRP per transaction, over 184 times the original supply. Liao also reported a $250,000 bounty.

The payment engine flaw involved integer overflow: an oversized total wrapped into a much smaller number. Sellers could receive full payments while buyers paid almost nothing. A supply safeguard repeated the arithmetic error, allowing unauthorized XRP minting.

The exploit required deliberately abnormal trading offers across hundreds of accounts. Ordinary payments could not trigger it, according to the disclosure, despite the long exposure period.

XRP Ledger security bug fix prompts transparency debate

Developers shipped xrpld 3.4.1 with compiled software before releasing its source code. Justin Bons criticized the temporary withholding on X.

The overflow fix applied immediately when servers upgraded, bypassing the usual amendment delay. More than 80% of default UNL validators upgraded on release day.

A separate Batch fix activated through amendments on October 9. The Foundation also pledged broader formal verification, AI adversarial testing and researcher collaboration.