What to Know

  • An XRP Ledger bug that went undiscovered for more than a decade could have allowed an attacker to create billions of XRP in theory.
  • The flaw threatened XRP’s core fixed-supply rule, under which the total supply is capped at 100 billion tokens created at the blockchain’s debut in 2012.
  • The vulnerability was reported on Sept. 22 by researcher Cayden Liao and Veria AI.
  • RippleX shipped a fix after finding no evidence of exploitation or unauthorized XRP creation on a public network.
  • The XRP Ledger Foundation said normal user activity never came close to triggering the bug.
  • The bug required hundreds of carefully constructed operations to manipulate transaction costs and bypass standard fund checks.
  • The foundation said about 99.986 billion XRP remain in circulation today.
  • The bug is believed to have existed since 2015 and stemmed from an integer-overflow vulnerability.
  • The foundation plans to apply AI adversarial testing, formal verification and a stronger bug bounty program to improve future security.

Long-Hidden XRPL Bug Raised Questions Over XRP’s Fixed Supply

A vulnerability in the XRP Ledger that could have threatened XRP’s fixed supply limit remained hidden for years because ordinary network activity did not resemble the extreme transaction patterns required to trigger it, the XRP Ledger Foundation said. The issue drew attention because XRP’s value proposition has long depended in part on the rule that no new tokens can be minted beyond the 100 billion XRP created when the blockchain launched in 2012.

The bug, which had gone undiscovered for more than a decade, could have allowed an attacker to create billions of XRP under highly specific conditions. That scenario would have undermined the supply cap that many XRP holders view as a central design feature of the asset. However, RippleX patched the vulnerability after it was reported, and the parties involved said there was no evidence that the flaw had been exploited or that unauthorized XRP had been created on a public network.

The vulnerability was reported on Sept. 22 by researcher Cayden Liao and Veria AI. After review and remediation, the XRP Ledger Foundation said no damage had been done. It also said about 99.986 billion XRP remain in circulation today, keeping the network’s supply profile intact based on the information made public.

How the Vulnerability Could Have Worked

The flaw was an integer-overflow bug, a category of software error that occurs when a numerical value exceeds the maximum size a system can process and then wraps around to a much smaller value. In simple terms, it resembles a score counter in an old arcade game returning to zero after reaching its upper limit. On a financial ledger, that type of error can be far more serious because accounting systems depend on precise numerical handling.

In the XRP Ledger case, the vulnerability could have caused an extremely large transaction cost to wrap to a near-zero value. Under the theoretical attack path, manipulated costs could have bypassed standard fund checks while seller accounts still received full XRP payments. The difference between what the buyer effectively paid and what sellers received could have functioned like newly created XRP, even though the ledger is designed so that no new XRP can be minted.

Market participants focused on the seriousness of the issue because the XRP Ledger’s native token is not meant to operate like inflationary crypto assets that can issue new units over time. XRP was built with its supply created at inception, and the network uses the token for transaction fees as well as bridge currency activity on the ledger’s built-in decentralized exchange. A bug that could have distorted that accounting, even in theory, therefore went to the heart of the ledger’s monetary design.

Why Normal Activity Did Not Trigger the Bug

The XRP Ledger Foundation said the vulnerability stayed hidden mainly because the necessary conditions were far outside ordinary payment behavior. Normal payments did not come close to triggering the issue. Instead, it would have required hundreds of deliberately constructed operations, making the attack path highly abnormal compared with day-to-day XRP Ledger use.

The potential exploit involved setting up dummy accounts and posting fake token sales at extremely large XRP values. The attacker, acting as a buyer, could theoretically have bought all of the tokens at once. Because of the overflow behavior, the ledger could have credited seller accounts with large amounts of valid XRP while registering the buyer’s total cost as a tiny amount. That mismatch is what created the theoretical risk of supply inflation.

The bug’s unusual trigger conditions also help explain why it was not discovered through regular network activity. Most users send payments, pay fees, or interact with trading functions at scales that remain within ordinary numerical ranges. The problematic behavior emerged only when transaction structures were intentionally pushed toward extreme values and distributed across many operations.

Safeguards Missed the Supply Risk

The XRP Ledger included checks intended to confirm after each transaction that no new XRP had appeared. However, the post-transaction check relied on the same miscounted total affected by the bug, which meant it could see nothing unusual in the specific overflow scenario. That made the safeguard ineffective against this particular vulnerability.

A separate limit on how much XRP a single account can receive also did not resolve the issue because the possible attack could have spread the credited XRP across hundreds of accounts. By distributing the activity broadly, the theoretical exploit would have avoided tripping a single-account threshold while still creating a much larger aggregate supply problem.

This combination of factors made the issue difficult to catch. The vulnerability was not simply a matter of sending one large payment or exploiting an obvious single-account weakness. It depended on carefully constructed activity, multiple accounts, and numerical behavior that did not match typical user transactions.

No Evidence of Exploitation Found

RippleX shipped the fix after the vulnerability was reported and reviewed. The key point for XRP holders is that the parties involved said they found no evidence of exploitation or unauthorized XRP creation on a public network. The XRP Ledger Foundation also said no new XRP was created as a result of the bug.

That distinction matters for market confidence. A theoretical ability to inflate supply is serious, but the impact differs significantly if the vulnerability was found and patched before any confirmed public-network exploitation. For XRP, where the 100 billion token cap is central to the asset’s economics, confirmation that unauthorized XRP was not created is an important element of the remediation narrative.

Still, the disclosure is a reminder that blockchain systems can carry long-lived vulnerabilities even when they have operated for years without obvious failure. Open-source networks benefit from broad review, but complex ledger logic can contain edge cases that only appear under highly unusual conditions. Technical traders and long-term holders alike often treat supply rules as fixed assumptions, yet those assumptions still depend on the correctness of the underlying software.

AI Testing Becomes a Bigger Security Priority

The XRP Ledger Foundation said artificial intelligence is making it faster to find software flaws for both malicious actors and defenders. That observation reflects a broader shift in blockchain security. AI-assisted tooling can help researchers explore unusual input combinations, identify edge cases and automate parts of vulnerability discovery. At the same time, those capabilities can also lower the cost of searching for exploitable weaknesses.

To strengthen future security, the foundation plans to apply AI adversarial testing more aggressively, implement formal verification and strengthen its bug bounty program. AI adversarial testing can help simulate hostile behavior and unusual transaction patterns. Formal verification aims to mathematically prove that certain code properties hold under defined conditions. Bug bounty programs provide incentives for independent researchers to report vulnerabilities responsibly rather than exploit them.

For crypto networks that secure significant market value, these steps are increasingly important. A ledger’s credibility depends not only on fast transaction processing or ecosystem adoption, but also on the reliability of its core accounting rules. When a network promises a fixed supply, its software must consistently enforce that rule even under abnormal conditions.

What It Means for XRP and the Ledger

The disclosure places renewed attention on XRP’s supply model, but it also shows that the vulnerability was identified, reported and patched without public evidence of damage. The bug’s existence since 2015, as believed by the foundation, underscores how deeply buried some edge cases can be in mature blockchain code. The fact that normal payments did not trigger the issue explains why it could persist for so long without surfacing during everyday use.

For XRP holders, the central takeaway is that the 100 billion token cap was theoretically at risk from a software flaw, but no unauthorized token creation has been found on a public network. For developers and validators, the episode reinforces the need to test not only common transaction paths but also extreme and adversarial cases designed to break assumptions.

FXCOINZ market coverage will continue to track how the XRP Ledger Foundation and RippleX approach security upgrades following the disclosure. The planned focus on AI testing, formal verification and stronger researcher incentives could become an important part of the network’s long-term defense strategy as blockchain vulnerabilities become easier to search for and potentially easier to weaponize.

Frequently Asked Questions (FAQs)

What was the XRP Ledger bug?

The bug was an integer-overflow vulnerability that could have allowed manipulated transaction costs to wrap to a near-zero value while seller accounts received full XRP payments, theoretically creating new XRP.

Why was the bug considered serious?

It was serious because XRP is designed with a fixed supply cap of 100 billion tokens created at the blockchain’s debut in 2012. A bug that could create additional XRP would threaten that core rule.

Was the bug exploited?

RippleX patched the vulnerability after finding no evidence of exploitation or unauthorized XRP creation on a public network. The XRP Ledger Foundation said no new XRP was created.

How long did the vulnerability exist?

The bug is believed to have existed since 2015 and went undiscovered for more than a decade because ordinary network activity did not trigger the required conditions.

Who reported the vulnerability?

The vulnerability was reported on Sept. 22 by researcher Cayden Liao and Veria AI, after which it was handled internally and fixed by RippleX.

Why did normal XRP Ledger activity not reveal the bug?

The XRP Ledger Foundation said normal payments did not come close to triggering the issue. The vulnerability required hundreds of deliberately constructed operations and extreme transaction conditions.

How could an attacker have used the flaw in theory?

An attacker could theoretically have used dummy accounts and fake token sales at extremely large XRP values, causing the ledger to credit seller accounts with large amounts of XRP while charging the buyer a near-zero amount.

How much XRP remains in circulation?

The XRP Ledger Foundation said about 99.986 billion XRP remain in circulation today, and no unauthorized XRP creation was found on a public network.

What security steps are planned after the bug fix?

The foundation plans to apply AI adversarial testing, implement formal verification and strengthen its bug bounty program to help identify and address future vulnerabilities.