A recently discovered flaw in the XRP Ledger’s code put billions of dollars in XRP at potential risk, but was swiftly resolved with an emergency update to its core software, xrpld 3.4.1, released on September 25. The bug, present since 2015, could have allowed anyone to mint nearly unlimited XRP, raising significant concern among developers and users of the network.
Discovery and escalation of the vulnerability
Cayden Liao, a security researcher, and Veria AI flagged the critical issue through the XRP Ledger bug bounty program on September 22. Initially rated as a major threat, RippleX engineers quickly upgraded its classification to critical after simulating the bug on a standalone server and proving that the newly issued XRP could be spent in subsequent transactions.
The vulnerability stemmed from unchecked 64-bit addition within the payment engine’s code. An attacker could have exploited this by opening several hundred accounts, placing offers to trade an enormous amount of XRP for a minimal amount of other tokens, then routing a payment through each offer. This manipulation would cause the sum to overflow back to a much smaller figure, resulting in each offer owner receiving the full stated amount while the payer’s account was only debited by a tiny sum.
Neither of the usual safety checks—an invariant to prevent XRP creation and a per-account holding limit—was sufficient to block this exploit. The report determined that only a modest reserve of XRP and associated fees were necessary to orchestrate the attack.
Mini dictionary: RippleX, a division of American technology company Ripple, is responsible for supporting the development, security, and scaling of the XRP Ledger open-source protocol.
Rapid fix and protocol exception
The corrective update was deployed immediately on all servers running the XRP Ledger, bypassing the network’s standard requirement that amendments must achieve over 80% validator consensus for two weeks. The development team cited the open-source nature of xrpld as the reason for skipping this process; a public vote could have left the vulnerability exposed for weeks.
More than 80% of the network’s default UNL (Unique Node List) validators upgraded to version 3.4.1 on release day, before the source code was published. The report noted that the code is now publicly available.
In a statement, project engineers argued that bypassing the regular amendment process was warranted only for “the most severe bugs, where the exploit is even worse than a network halt.”
The report confirmed that no evidence was found of this flaw being exploited on any public network. After the emergency patch, the XRP Ledger Foundation reaffirmed that no new XRP had been minted, stating, “About 99.986 billion XRP exist today.”
Bug details and further security measures
Liao, referencing the bug on X, highlighted the risk, saying the flaw “let anyone mint infinite XRP, with $94 billion at risk.” However, the official report did not provide specific figures on the potential losses.
The XRP Ledger Foundation added, “AI makes bugs like this faster to find, for the bad guys and the good guys.”
Alongside the critical flaw, the report detailed a separate, lower-priority bug affecting the new Batch feature, which was not yet available on Mainnet at the time. This issue was addressed through the fixBatchV1_2 amendment on October 9. Project developers stated that every resolved security finding will now undergo extended retesting for each release candidate prior to final closure.
