A vulnerability in the XRP Ledger remained undetected for more than 10 years because ordinary transactions could not trigger it, according to CoinDesk. In theory, the flaw could have enabled an attacker to create billions of XRP without authorization, challenging the network’s foundational 100 billion-token supply limit. RippleX has patched the issue, and the XRP Ledger Foundation said there is no evidence that anyone exploited it or that unauthorized XRP was created.
A hidden threat to XRP’s fixed supply
The XRP Ledger is an open-source, decentralized layer-1 blockchain. XRP is its native cryptocurrency and is used primarily to pay transaction fees and facilitate currency exchanges through the ledger’s built-in decentralized exchange.
Unlike cryptocurrencies whose supply can increase through mining or other issuance mechanisms, XRP was designed with a maximum supply of 100 billion tokens, created when the ledger launched in 2012. That ceiling is a central feature of the asset’s design. The foundation said approximately 99.986 billion XRP remain in circulation.
The vulnerability is believed to have existed since 2015. It was identified on Sept. 22 by researcher Cayden Liao and Veria AI, who reported it internally. RippleX then released a fix after determining that the issue had not been used on a public network.
The problem did not mean that new XRP was routinely being issued. Instead, it created a theoretical route around the ledger’s accounting and transaction checks under very specific circumstances.
How the exploit could have created XRP
The flaw was an integer overflow, a software error that occurs when a numerical value exceeds the maximum size the system can handle. When that happens, the value can wrap around to a much smaller number rather than being recorded at its true size.
On the XRP Ledger, an attacker could have prepared hundreds of specially constructed operations and dummy accounts. Those accounts could post token sales involving extremely large XRP amounts. The attacker would then act as the buyer and complete the purchases in a way that caused the calculated transaction cost to wrap to an almost negligible amount.
The seller accounts would receive the full XRP amounts, while the system would record only a tiny cost for the buyer. In effect, the difference could have been created without the corresponding funds existing beforehand. The attacker could then have held billions of newly created XRP and potentially attempted to sell them through external exchanges.
The attack depended on scale and careful preparation. It was not a weakness that could be activated through an ordinary payment or a simple transaction.
Why the safeguards did not catch it
The XRP Ledger Foundation said normal user activity never approached the threshold needed to activate the bug. Its explanation said the exploit required hundreds of deliberately engineered operations, which helped keep the problem hidden for years.
The ledger’s internal defenses also relied on the same inaccurate calculation. A check performed after each transaction was intended to verify that no additional XRP had been created. Because the total was miscounted in the relevant scenario, that check would not have identified the discrepancy.
Another safeguard limits the amount of XRP that a single account can receive. That protection would not necessarily have stopped the proposed attack because the newly credited tokens could have been distributed across hundreds of accounts rather than concentrated in one wallet.
The foundation and RippleX said they found no evidence of exploitation, and the source material reports that no new XRP was created as a result of the bug. The fix therefore addressed a potential threat to the ledger’s monetary rules rather than damage already confirmed on the public network.
What happens next—and the current market picture
The foundation said artificial intelligence is making it faster for both attackers and security researchers to discover software weaknesses. It plans to expand adversarial testing using AI, introduce formal verification and strengthen its bug bounty program. Formal verification generally involves mathematically checking whether software behaves according to specified rules, while a bug bounty program rewards researchers who responsibly report vulnerabilities.
The incident matters beyond the specific coding error because a cryptocurrency’s supply rules depend on the software enforcing them correctly. A fixed supply can be undermined if accounting functions fail under unusual conditions, even when everyday users see no visible problem. The patch and the absence of reported unauthorized issuance mean the issue was contained before the scenario described by researchers became a public-network event.
Moneyiar market data at 09:39 on Oct. 13, 2026, show XRP at $1.3634818273, down 2.75% over 24 hours and 9.3% over seven days. Other assets in the supplied data were mixed: Cap was $0.0929758914, up 0.35% in 24 hours and 22.65% over seven days; edgeX was $0.337371181, down 6% and 25.54%, respectively; and Meteora was $0.3903474531, down 1.28% over 24 hours but up 27.08% over seven days.
