XRP Ledger patches bug that could have minted XRP from nothing

Researchers showed how a payment on the XRP Ledger could create spendable XRP without the sender funding it — a flaw believed to date to 2015 that threatened the token's fixed 100 billion supply. The integer-overflow bug exploited a counting error in the ledger's built-in exchange, letting an attacker open hundreds of accounts, offer a tiny amount of one token for huge amounts of XRP, and buy every offer at once so sellers were paid in full while the buyer was charged almost nothing.

The XRP Ledger Foundation says normal user activity never came close to triggering the flaw — the attack required hundreds of deliberately constructed operations — which is why it went undetected for more than a decade. The ledger's own post-transaction supply check relied on the same miscounted total and saw nothing unusual, and per-account receive limits didn't apply because the XRP was spread across many accounts. RippleX shipped the fix in xrpld 3.4.1 on Sept. 25 after finding no evidence of exploitation; no new XRP was created.

• Found by researcher Cayden Liao and Veria AI, reported internally Sept. 22; RippleX confirmed the minted XRP could be spent.
• The foundation plans AI adversarial testing, formal verification and a stronger bug bounty program going forward.