XRP Ledger patches 2015 integer overflow bug that could have minted XRP past 100 billion cap
XRP Ledger developers fixed a decade-old integer overflow in the payment engine that could have allowed creation of spendable XRP beyond the fixed 100 billion supply, with no evidence of exploitation on public networks.
Read this event in português (Brasil)
Why it matters
The bug threatened XRP's core supply integrity — its fixed 100 billion cap is a foundational guarantee for institutional adopters. The silent patch before public disclosure and rapid validator adoption limited exposure, but the decade-long dormancy of such a critical flaw raises questions about code review processes in mature blockchain protocols.
Where the sources disagree
Potential financial impact of the bug
infinite XRP, $94B at risk
Unchained
no XRP or dollar amount specified
Unchained
Researcher Cayden Liao claimed on X that the bug 'let anyone mint infinite XRP, with $94B at risk,' but the official vulnerability disclosure report gives no XRP or dollar amount.
Key facts
An integer overflow vulnerability existed in the XRP Ledger payment engine since 2015
Reported by CoinDesk
The flaw could have allowed creation of spendable XRP beyond the 100 billion fixed supply cap
100,000,000,000 tokensReported by CoinDesk
Cayden Liao and Veria AI reported the vulnerability via the XRPL bug bounty program on September 22, 2026
Reported by CoinDesk
RippleX reproduced the exploit on a standalone server and confirmed newly created XRP could be spent
Reported by CoinDesk
No evidence the vulnerability was exploited on any public network
Reported by CoinDesk
Public vulnerability disclosure published on October 9, 2026 alongside fixBatchV1_2 amendment activation
Reported by CoinGape
What happened
Researchers Cayden Liao and Veria AI reported a critical integer overflow vulnerability in the XRP Ledger's payment engine through the bug bounty program on September 22, 2026. The flaw, present since 2015, allowed a crafted payment consuming hundreds of mispriced DEX offers to overflow a 64-bit counter, letting an attacker receive XRP without paying for it. RippleX reproduced the exploit on a standalone server, confirmed the newly minted XRP was spendable, and released an emergency fix in xrpld 3.4.1 on September 25. Over 80% of default UNL validators adopted the patch by release day. The maintainers disclosed the vulnerability on October 9, stating they found no evidence of exploitation on any public network. The ledger's invariant check meant to prevent XRP creation used the same flawed arithmetic and failed to catch the bug.
How the story developed
- Update
Vulnerability reported via bug bounty
Cayden Liao and Veria AI submit critical bug report through XRPL bug bounty program
- Official statement
Emergency patch released
RippleX ships xrpld 3.4.1 with fix; over 80% of default UNL validators adopt by release day
- Official statement
Public vulnerability disclosure
XRP Ledger maintainers publish disclosure report; fixBatchV1_2 amendment goes live
- First report
First report by CoinDesk
XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing
- Update
Bug introduced in payment engine
Integer overflow flaw added to XRP Ledger payment engine code
- Update
CoinDesk breaks story to public
First major media report on the patched vulnerability
- Independent corroboration
Independently corroborated by CoinGape
RippleX Confirms No Evidence of Exploitation After Emergency XRPL 3.4.1 Patch
- Official statement
Official statement from Bitcoin.com News
A Decade-Old XRP Ledger Bug Could Have Minted XRP Out of Thin Air
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 10 Oct 2026, 04:20 UTC: CoinDesk — 1 independent source, 1 reports
- 10 Oct 2026, 07:02 UTC: The Crypto Basic — 2 independent sources, 3 reports
- 10 Oct 2026, 07:59 UTC: CoinGape — 3 independent sources, 4 reports
- 10 Oct 2026, 08:02 UTC: Bitcoin Insider — 4 independent sources, 5 reports
- 10 Oct 2026, 09:00 UTC: Bitcoin.com News, official — 5 independent sources, 6 reports
- 10 Oct 2026, 11:45 UTC: Crypto News Flash — 6 independent sources, 7 reports
- 12 Oct 2026, 09:37 UTC: Unchained — 7 independent sources, 8 reports
- 12 Oct 2026, 15:56 UTC: Decrypt — 8 independent sources, 9 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | A Decade-Old XRP Ledger Bug Could Have Minted XRP Out of Thin Air | Independent | |
| CoinDesk Crypto media | XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing | Original | |
| Unchained Crypto media | XRP Ledger Fixes Bug That Could Have Broken the Token’s Fixed Supply | Independent | |
| Decrypt Crypto media | XRP Ledger’s Payment Engine Had a Counterfeiting Bug Hiding Since 2015 | Independent | |
| CoinGape Crypto media | RippleX Confirms No Evidence of Exploitation After Emergency XRPL 3.4.1 Patch | Independent | |
| Crypto News Flash Crypto media | XRP Ledger Fixes Decade-Old Bug That Could Have Inflated XRP Supply | Independent | |
| The Crypto Basic Crypto media | XRPL Bug Found That Could Have Created New XRP From Nothing | Syndicated | |
| Bitcoin Insider Aggregator | Fix Deployed for Bug That Risked Minting XRP Beyond Its Fixed Supply Limit | Syndicated | |
| Bitcoin Insider Aggregator | XRP Ledger Patches Decade-Old Bug That Could Have Created Billions in XRP | Aggregated |
Related events
XRP Launches Official X Account Managed by Ripple and XRP Ledger Foundation
XRP debuted its official @XRP account on X on October 19, 2026, with a logo video and greeting, drawing welcomes from Ripple executives and the XRP Ledger Foundation.
Doppler Finance's XRP Vault crosses 90 million XRP, worth more than $125 million
Doppler Finance says its XRP Vault on the XRP Ledger passed 90 million XRP, worth more than $125 million, with combined XRP and RLUSD vaults holding $150 million from 14,000-plus depositors.
Armada shareholders approve Evernorth merger, clearing path for XRPN Nasdaq listing
Armada Acquisition Corp. II shareholders approved their merger with XRP treasury company Evernorth on Sept. 30, ahead of a planned Oct. 8 Nasdaq debut under the ticker XRPN.
Evernorth Completes SPAC Merger With Armada Acquisition Corp. II, Begins Nasdaq Trading as XRPN With 473 Million XRP
Evernorth closed its merger with Armada Acquisition Corp. II on October 9 and began Nasdaq trading under ticker XRPN on October 12, holding 473 million XRP and $300 million in gross cash proceeds.
Evernorth Begins Nasdaq Trading as XRPN With 473 Million XRP Treasury
Ripple-backed Evernorth started trading on Nasdaq under ticker XRPN on October 12 after merging with Armada Acquisition Corp. II, holding 473 million XRP and $300 million cash.
Standard Chartered opens RLUSD custody in Dubai, plans LMAX collateral mirroring
Standard Chartered began holding Ripple USD for eligible institutions through its DFSA-regulated Dubai branch and is working with Ripple and LMAX Group on turning those balances into trading collateral.