A bug hidden in the XRP Ledger’s payment engine since 2015 could have let an attacker create spendable XRP far beyond the fixed 100 billion supply. The XRP Ledger disclosure report published on 9 October 2026 confirms the flaw was patched in xrpld 3.4.1 on 25 September and found no evidence that it was ever exploited on a public network. The same report details a second bug in the new Batch feature, fixed before Batch went live on mainnet the same day.
The overflow bug: how it was found
The XRP Ledger vulnerability was an integer overflow in the way the payment engine adds up offer amounts. The safety check meant to guarantee that no XRP is ever created used the same unchecked arithmetic, so it missed the problem. According to the report, the attack would have cost only a few hundred XRP in recoverable reserves, plus fees.
Researcher Cayden Liao and Veria AI submitted the bug through the XRPL bug bounty programme on 22 September. Veria Labs says its AI agent spotted the flaw on 21 September and, on a local test network, built a proof of concept that minted about 18 trillion XRP in a single transaction, roughly 184 times the total supply. RippleX reproduced the issue and raised its severity from major to critical. On 8 October Veria received the programme’s maximum bounty of $250,000, according to its own account.
An emergency fix that skipped the vote
Changes to how the XRP Ledger processes transactions normally go through amendments, which need support from more than 80% of trusted validators for two weeks before they activate. This time, the fix took effect as soon as each server upgraded. The report says it is the first time a transaction-processing change has been shipped that way on purpose.
The reasoning, as set out by the XRPL Foundation, RippleX and validators: the exploit was cheap and open to anyone, the damage would have been hard to reverse, and publishing open-source code during a two-week vote would have revealed the bug. The report admits the trade-off. A network running mixed versions could have halted, which the team judged better than accepting exploit transactions. More than 80% of default UNL validators were running 3.4.1 on the day it was released.
On 11 October the Foundation stressed on X that XRP’s supply was fixed at 100 billion at launch and that no transaction is allowed to create more, as crypto.news reported.
The Batch bug and the 9 October activation
The second issue concerned Batch, a feature that lets users bundle up to eight transactions into one. On 18 September Denis Angell of the XRPL Foundation found that an earlier fix was incomplete, and RippleX engineer Mayukha Vadari later identified a risk of disagreement between server versions. Ripple and other validators withdrew their votes for the BatchV1_1 amendment on 23 and 24 September to reset its activation clock. The fixBatchV1_2 amendment was enabled on 9 October and, according to crypto.news citing XRPScan, BatchV1_1 activated the same day with 30 validators in favour and 5 against. Servers that have not upgraded are now amendment-blocked.
A governance debate
The bypass has revived questions about decentralization on the ledger. On 13 October 24/7 Wall St. quoted independent validator XRP Kuwait, which argued that “coordination is not the same as control” while admitting the network has decentralization challenges. Bitcoin and Ethereum have shipped coordinated emergency fixes in the past, notably Bitcoin’s value overflow bug in 2010.
What it means for XRP holders
No user funds were lost, no private keys were exposed and the XRP supply cap of 100 billion still holds, according to the Foundation. Holders do not need to do anything. The episode is a reminder that a coin’s tokenomics are only as solid as the software that enforces them.
The Foundation now retests every security finding against release candidates before closing it, whether it comes from audits, bug bounties or AI-assisted testing. That matters as the ledger courts institutions: features such as PermissionDelegation, which lets stablecoin issuers and custodians delegate payments or approvals without handing over their keys, have been moving through the same amendment process, CoinDesk reported.
What to watch
- How quickly the remaining validators and node operators move to 3.4.1 or later.
- Whether the Foundation formalizes rules for future emergency patches, which it says do not change the amendment process.
- The pace of AI-assisted bug hunting across other blockchains. For the basics of how ledgers validate transactions, see our guide What is a blockchain.