XRPL Patches a Decade-Old Bug: One Payment Could Have Printed Billions in XRP From Nothing
A chain that has run for ten years, a ledger hard-coded to "100 billion total" — nearly got extra money conjured by a single transaction. Not sci-fi; it's a security report only made public on October 9.
Three key facts
The XRP Ledger had a vulnerability dating to 2015 that theoretically let an attacker create spendable XRP out of thin air, breaking the project's fixed supply cap of 100 billion tokens. According to CoinDesk, the flaw came from a counting error in the ledger's built-in order-matching exchange: an attacker could open hundreds of accounts, each offering a tiny amount of a token in exchange for an unusually large amount of XRP, then send a single payment that bought every offer at once.
The attack worked through "the total exceeding what the software could count." The XRP owed was too large for the software to tally correctly, so the selling accounts were paid in full while the buyer's account was charged almost nothing — leaving the attacker with XRP that hadn't existed before. The ledger runs a check after every transaction for newly created XRP, but that check relied on the miscounted total; a separate per-account receive limit wouldn't trigger either, because the XRP was spread across hundreds of accounts.
RippleX says it found no evidence of exploitation on public networks, and the flaw is fixed. The bug was found by researcher Cayden Liao and Veria AI, reported internally on September 22, and engineers reproduced the attack on a standalone server. The fix shipped in the xrpld 3.4.1 software release on September 25, without disclosing what it repaired. The report adds this is part of a run of long-hidden crypto flaws surfaced with AI help since July.
Wang Dou's Take
The most striking part isn't the bug — it's how long it hid. A counting error present since 2015 only got dug up in 2026, through ten years of astronomically large transaction volume, while the ledger's "supply check" kept trusting the same wrong number. "Immutability" was always about others not being able to change things — never about whether it had miscounted itself.
The second striking part is how it was fixed: a patch shipped September 25 without telling users what it repaired. That's standard practice in security — plug it first, explain later, to avoid teaching attackers before the patch spreads. But flip it around and it says something too: had no one found this hole, it might still be open today, and every institutional investor watching that "100 billion cap" was trusting an assumption they had never verified.
Third, everyone should remember this: the report is explicit that these flaws were dug up "with AI help." That means the old rule — "write good code and you're safe" — is being rewritten. AI can comb corners no human has touched in a decade, with speed and patience people can't match. Defenders' tools are upgrading, and so are attackers' — and a ledger doesn't get an exemption just for being an "old-guard public chain."
Source: CoinDesk · XRPL Security Report