A flaw present in the XRP Ledger payment engine since 2015 could have let an attacker mint spendable XRP (XRP) beyond its 100 billion supply cap, developers said.
Key Points:
- A researcher using an AI security tool reported the overflow bug on Sept. 22 through the network's bug bounty program.
- Developers shipped a fix three days later, skipping the usual validator vote for the first time in over a decade.
- Maintainers found no evidence that anyone exploited the flaw.
XRP Counterfeiting Bug
XRP Ledger maintainers disclosed the flaw in a vulnerability report on Oct. 9, saying a researcher flagged it through the network's bug bounty program on Sept. 22. RippleX, the developer arm of Ripple, rated it critical after reproducing the attack. The team found no sign that anyone ever exploited it.
The overflow sat in the payment engine, which used unchecked 64-bit math to total what a buyer owed when a single payment filled many order book offers at once.
Hundreds of deliberately mispriced offers could push that total past its limit and wrap it around to a tiny number, so sellers got paid in full while the buyer paid almost nothing. The ledger's own safety check against new XRP used the same arithmetic, so it missed the counterfeit coins entirely.
Also Read: GPT-6.1 Sol Helped Cut Asana’s Agent Costs 76 Times, But Here’s The Catch
Cayden Liao Explains
Cayden Liao, security co-founder at Veria Labs, wrote on X that the firm's AI agent found the bug and built a working exploit. By his count, one transaction could have minted about 18 trillion XRP. He suspects nobody caught it earlier because it "chains together two bugs that would be low severity on their own."
Liao said Ripple paid Veria the program's maximum $250,000 bounty. J. Ayo Akinyele, who leads engineering at RippleX, said the team would widen its use of AI-assisted bug hunting and formal verification, noting that AI is "fundamentally changing how quickly vulnerabilities can be discovered."
XRPL Emergency Patch
The fix shipped in xrpld version 3.4.1 on Sept. 25, three days after the report. More than 80% of trusted validators ran it that day, and the change took effect without the usual two-week amendment vote, a first in over a decade. Developers argued that releasing open-source code under the normal process would have shown attackers the bug for weeks before the patch kicked in.
In 2010, a Bitcoin (BTC) overflow bug created more than 184 billion coins in one transaction before developers fixed it within hours and forked the chain to erase them. Zcash (ZEC) also rushed to patch a counterfeiting flaw this year, and the scare sent its token sharply lower.
Read Next: French Crypto Holders Could Owe Up To 10,000 Euros For Unreported Wallets
