XRP Ledger fixes 2015 bug that could have minted XRP past its 100bn cap

What’s going on here?

Researcher Cayden Liao and the firm Veria AI reported the flaw through the XRP Ledger's bug bounty program on September 22, CoinDesk reported. Engineers at RippleX, Ripple's developer arm, reproduced the attack the next day, rated it critical and merged a fix. The repair shipped in version 3.4.1 of the network's server software, xrpld, on September 25, and more than 80% of the default trusted validators were running it that same day, according to Bitcoin.com News. The public disclosure came on October 9. RippleX said there was no sign anyone had used the bug on a live network.

What does this mean?

XRP's design rests on a hard limit. All 100 billion tokens were created when the ledger launched in 2012, and the software is meant to make it impossible to add more. A fixed supply is a big part of why institutions are willing to hold and build on a cryptocurrency, because it means their holdings cannot be diluted by new tokens appearing.

The flaw sat in the ledger's native trading venue, where users list bids to trade tokens with each other. In theory, a bad actor might have opened hundreds of accounts, each offering a tiny amount of a token for a huge amount of XRP, and then sent one payment that filled every offer at once. The software added up those amounts using 64-bit arithmetic without checking for overflow. When a number grows too big for that space, it wraps around to a small one, much like an old car odometer rolling back to zero. Sellers would have been paid in full while the buyer was charged almost nothing, leaving brand-new XRP in the attacker's hands.

The ledger does run a safety check after each transaction to confirm no XRP was created, but it used the same faulty math, so it would have missed the problem. The cost of an attack was small: a few hundred XRP held as reserves, mostly recoverable, plus fees. That gap between cost and potential damage is why RippleX treated it as critical.

Developers shipped the fix without saying what it repaired and released the code only afterward, a common practice to avoid tipping off attackers. The episode adds to a series of long-hidden crypto security flaws found with the help of AI tools since July, CoinDesk noted.

The bull case

The process worked. The bug came in through a formal bounty program, was reproduced and fixed within three days, and most validators upgraded on day one, before anyone outside knew. No XRP was created and no funds were lost. For institutions weighing the network, a fast, quiet fix followed by full disclosure could strengthen confidence in how the XRP Ledger is maintained.

The bear case

A flaw that could break XRP's supply cap went unnoticed for about a decade, and the very check meant to catch it shared the same weakness. That raises questions about what else may be hidden in older code. It also lands as Ripple-backed Evernorth prepares to list on Nasdaq with about 473 million XRP on its books, putting supply integrity under a brighter spotlight.