Key Insights
- Supply integrity remained intact. Investigators reported no evidence of exploitation on public networks, despite confirming the attack in controlled testing.
- The answer focused on speed. The September 25 emergency release was made as an exception to the normal amendment process in order to minimize exposure.
- Independent verification is still a must.The flaw affected both payment calculations and a related safety check, showing how shared logic can weaken multiple protections.
The XRP Ledger patched a critical software vulnerability on September 25, 2026, that could have enabled attackers to create spendable XRP beyond the network’s 100 billion token supply cap. RippleX confirmed the exploit could work in controlled testing, but investigators found no evidence of attacks against public networks before the disclosure on October 9.
The vulnerability exposed a weakness in the ledger’s payment engine that apparently existed since 2015. Developers released an emergency update within three days of receiving the report, prioritizing network security over the standard amendment process.
How the vulnerability could create unauthorized XRP
The XRP Ledger vulnerability involved an integer overflow in the software responsible for processing payments involving multiple offers on its built-in decentralized exchange. The payment engine used a 64-bit integer to calculate the total XRP owed during certain transactions.
But, if the payment used too many of the very large offers, the calculation may overflow the maximum value of an integer. Yet rather than rejecting the transaction, it rolled over to a much smaller number.
This vulnerability could be used by an attacker to establish hundreds of accounts and publish attractive offers. Every account would be willing to provide a tiny bit of one token for a very large amount of XRP.
These offers could then be eaten in one go. The XRP amount on the selling account would be credited, and the incorrect amount on the buying account would be deducted.
Consequently, the difference could become newly created XRP that the attacker could spend in subsequent transactions. The attack could potentially generate more XRP than the ledger’s entire intended supply.
The existing safeguards also presented a problem. The system’s check for unauthorized XRP creation relied on similar arithmetic, allowing the same overflow to undermine its verification process.
Emergency patch followed September disclosure
Researcher Cayden Liao and Veria AI identified the flaw and reported it through the XRP Ledger’s bug bounty program on September 22, 2026. RippleX engineers subsequently reproduced the exploit on a standalone server and confirmed that the excess XRP remained spendable.
The team rated the vulnerability critical because it threatened the ledger’s fixed-supply rules. However, investigators found no evidence that anyone exploited the flaw on XRPL Mainnet or another public network.
Developers released xrpld 3.4.1 on September 25, adding checks that detect overflow during offer calculations. The update also strengthened the safeguard responsible for verifying that transactions do not create XRP.
The emergency response departed from the ledger’s usual governance procedure. Normally, protocol amendments require validator approval exceeding 80% for two weeks before activation.
Developers instead distributed the security fix directly through a software release. They wanted operators to upgrade before a public disclosure exposed the vulnerable code to potential attackers.
More than 80% of validators on the default trusted validator list reportedly ran version 3.4.1 or later on September 25. The team published the vulnerability details on October 9, after operators had time to deploy the patch.
The impact on XRP supply and network security
The incident underscores the dangers that well-known blockchain software can pose to basic laws of the economy due to arithmetic mistakes. A critical security issue would be if there were some vulnerability in the code that allows for the creation of more XRP tokens, because XRP has a fixed supply. Because of XRP’s fixed supply, a critical security issue is if there was some vulnerability in the code that allowed for the creation of more tokens of XRP.
The researchers confirmed the exploit in its tests but the lack of known public exploitation makes this incident different from a public supply manipulation or financial loss. The release also questions the emergency security measures. The fact that the amendment was skipped meant that the vulnerability was available for attackers to discover and exploit for less time after it was made public.
But for direct software releases, developers and node operators are at a greater risk. Network participants are required to keep current and have confidence in the security review process.
The vulnerability also reinforces the importance of independent testing. The same flaw in arithmetic was found in both the transaction processing and a protection measure to prevent unauthorized XRP creation.
The event comes after a broader investigation of the cryptocurrency infrastructure, in which weaknesses can be around for years before they are discovered. Consequently, established networks must continue testing legacy code as transaction complexity and institutional use expand.
Conclusion
The XRP Ledger addressed a critical vulnerability before investigators found evidence of public exploitation. Its September emergency patch prevented a potential route to unauthorized XRP creation beyond the 100 billion supply cap.
The episode nevertheless demonstrates the risks embedded in longstanding blockchain software. Continued testing, prompt upgrades and stronger safeguards will remain essential to preserving confidence in the network’s supply rules.
