RippleX patched a critical XRP Ledger bug that could have minted billions of XRP, and says it found no evidence of exploitation. The fix shipped in xrpld 3.4.1 on September 25, with public disclosure following on October 9.
RippleX confirmed there is no evidence that a decade-old XRP Ledger flaw was ever exploited on any public network. Left unfixed, the integer overflow could have silently minted billions of XRP and broken the token's fixed supply of 100 billion.
How the overflow flaw worked
Cayden Liao and Veria AI reported the bug through the XRPL Bug Bounty program on September 22, 2026. It traced back to the payment engine written around 2015, which summed XRP amounts across offers on the built-in DEX.
An attacker could open hundreds of accounts and place tiny, mispriced offers, trading small amounts of a token for large amounts of XRP. One crafted payment consuming all those offers at once would make the 64-bit counter overflow and wrap around, so sellers received their full XRP while the buyer paid almost nothing.
The ledger's own "no XRP created" check used the same flawed arithmetic, so it missed the overflow. The attack would have cost only a few hundred XRP in reserves, most of it recoverable, plus fees.
Emergency patch ships before disclosure
RippleX reproduced the exploit on a standalone server and confirmed it produced spendable tokens. Developers then released the emergency fix in xrpld 3.4.1 on September 25 without initially saying what it repaired.
By release day, over 80% of default UNL validators were already running 3.4.1. Normal transaction activity never reached the arithmetic limits, according to the report.
Institutional projects rest on supply integrity
CoinGape links the timing to institutional interest in XRP. Evernorth's 473 million XRP treasury deal is advancing toward a Nasdaq listing.
Separately, Ripple Prime launched stock trading through its Delta One business.
Meritz Securities also signed Ripple to explore custody and tokenization for Korean capital markets. CoinGape argues that all of this momentum depends on the integrity of XRP's fixed supply.
Source: CoinGape
Trading involves risk.
Risk Disclaimer
