The XRP Ledger team has corrected a severe security flaw that could have resulted in the unauthorized creation of 18 trillion XRP, safeguarding the network against a potentially catastrophic breach. Security researcher Cayden Liao discovered the vulnerability and received a $250,000 bounty as a reward for responsible disclosure.
Major supply risk identified in XRP Ledger
The technical flaw, traced to the payment engine of the XRP Ledger, was an overflow bug with the potential to generate a massive amount of XRP through a specially crafted transaction. Liao and his team demonstrated with a proof of concept that, if exploited, a single transaction could have created 18 trillion XRP—drastically exceeding the network’s fixed cap of 100 billion coins.
The XRP Ledger, introduced in 2012, is structured to maintain a hard cap of 100 billion XRP. In contrast to other leading cryptocurrencies, XRP coins are neither mined nor staked. Transaction fees gradually reduce the circulating supply over time as small quantities of XRP are destroyed with each network transaction.
This newly revealed bug threatened the principle of fixed supply that underpins confidence in XRP. Liao stated that the overflow flaw could have undermined financial integrity across the network, as it would allow vastly more coins to be spent than initially introduced. To date, developers have not identified any public evidence that malicious actors exploited the vulnerability.
The XRP Ledger’s fixed supply cap has been a central trust factor since its launch. Despite rigorous audits over the years, Liao’s proof of concept showed that an obscure overflow bug—hidden in code since 2015—could have permitted attackers to mint XRP more than 180 times the intended total supply.
With XRP among the world’s most valuable cryptocurrencies by market capitalization, a successful exploit could have severely damaged confidence and stability in the digital asset market.
Mini dictionary: Cayden Liao is a security researcher recognized for identifying major software vulnerabilities in cryptocurrency networks and contributing to blockchain security initiatives through responsible disclosure.
Rapid response and coordinated patch rollout
Developers publicly disclosed the vulnerability only after securing the XRP Ledger and RippleX network. The flaw was initially reported on September 22, 2026 through the XRPL bug bounty program. Within three days, developers deployed an emergency update, upgrading the xrpld node software to version 3.4.1.
Instead of conducting the standard two-week validator amendment process, the technical team opted for an immediate, confidential patch. This allowed over 80% of default validators to update their systems on the same day, mitigating the risk before details were made public. The team coordinated the public announcement on October 9 after confirming the network had been secured and the exploit window had closed.
Liao’s team earned the maximum $250,000 reward for what was described as an “unusually significant security finding.” The exploit required a combination of two bugs that, while previously considered low-risk, together allowed the possibility of an attack.
XRP Ledger’s audit record and network security
Over the past several years, the XRP Ledger Foundation has supported ongoing audits and launched bug bounty programs to encourage the responsible reporting of vulnerabilities. To date, over $1 million has been distributed to security researchers through these initiatives.
The latest incident highlights the ongoing importance of timely software updates and rigorous monitoring in blockchain networks. Validator node operators play a vital role in maintaining integrity, as quick upgrades are essential in minimizing the impact of discovered vulnerabilities.
Despite the extreme theoretical risk posed by the bug, no unauthorized creation of XRP was detected, and the network avoided any losses or disruptions to user funds. The episode closed with the flaw neutralized and normal network operations resumed.
