A security flaw in the XRP Ledger could have allowed attackers to create and spend newly generated XRP without properly funding the transaction, threatening the network’s fixed-supply design. The issue was discovered by researchers, reproduced by RippleX engineers and patched in September, with no evidence that it was exploited on a public network.
How the vulnerability worked
According to CoinDesk, the flaw was believed to date back to 2015 and involved the XRP Ledger’s built-in exchange. That feature allows accounts to post offers to trade one token for another directly on the ledger.
Researchers Cayden Liao and Veria AI reported the vulnerability internally on Sept. 22. RippleX, the developer arm associated with Ripple, reproduced the technique on a standalone server and confirmed that the XRP generated through the process could be spent in a subsequent transaction.
The attack depended on a counting error. An attacker could theoretically create hundreds of accounts, with each account offering a very small amount of another token in exchange for an unusually large quantity of XRP. A single payment could then execute all of those offers at once.
The combined amount of XRP owed would be too large for the software to calculate correctly. The selling accounts could receive the full amounts specified in their offers, while the account making the purchase would be charged almost nothing. The difference would effectively leave the attacker holding XRP that had not previously existed.
The method required only a few hundred XRP to create the accounts, most of which could later be recovered, as well as transaction fees. By distributing the newly created XRP across many accounts, the attacker could also avoid a separate limit on how much XRP one account could receive.
Why the bug threatened XRP’s supply model
The XRP Ledger launched in 2012 with all 100 billion XRP created at that time. Its software is designed to prevent the addition of new tokens, making the fixed supply a central feature of the network’s economic model.
The ledger performs a check after each transaction to verify that no new XRP has appeared. In this case, however, the check relied on the same incorrectly calculated total and could therefore fail to detect the newly created tokens. The account-level receiving limit also would not have stopped the attack because the funds could be divided among hundreds of accounts.
If exploited, the vulnerability could have allowed an attacker to sell unauthorized XRP on exchanges. That would have undermined the supply cap and potentially affected institutions that use the XRP Ledger while relying on its stated issuance rules. The source material does not report any public-network exploitation, and RippleX said it found no evidence that the flaw had been used in that setting.
Patch released without immediate disclosure
RippleX released the fix in xrpld 3.4.1, the server software used by the ledger, on Sept. 25. The software update was shipped without initially explaining which security issue it addressed. The nature of the repair became clear after the researchers’ findings were reported.
The incident highlights the potential significance of defects in core blockchain software. A flaw in a ledger’s transaction accounting can affect not only individual wallets but also rules that users expect to be enforced by the network itself, such as supply limits. In this case, the researchers’ demonstration showed that the unauthorized XRP could move in a later transaction, rather than remaining merely a bookkeeping error.
The discovery is also part of a recent series of long-hidden cryptocurrency vulnerabilities identified with the help of artificial intelligence since July. The source material cites a Coldcard wallet bug linked to the theft of at least 1,367 BTC and vulnerabilities that led Core Lightning to tell Bitcoin node operators to disconnect. Those incidents are separate from the XRP Ledger flaw.
XRP market picture
Moneyiar market data at 11:29 a.m. on Oct. 11, 2026, shows XRP at $1.3896767917, down 0.94% over 24 hours and 7.37% over seven days. The figures describe market performance at that stated time and do not establish a cause for the price movement.
The same Moneyiar data lists MON at $0.0251652727, up 2.26% in 24 hours but down 25.59% over seven days; EDGE at $0.3514163308, down 2.83% over 24 hours and 25.36% over seven days; and ARC at $0.0607125184, down 2.74% over 24 hours and 15.52% over seven days. These broader figures provide market context but are not evidence that the XRP Ledger vulnerability affected prices.
