XRP Ledger Bug That Could Have Broken 100 Billion Supply Cap Went Undetected for Over a Decade
Why an XRP supply threat went unnoticed for over a decade
A 11-year-old bug in the XRP Ledger could have allowed someone to create billions of new XRP tokens, breaking the network's strict 100 billion supply limit. The flaw stayed hidden because normal network activity never came close to triggering it, the XRP Ledger Foundation said.
The bug was discovered on September 22 by researcher Cayden Liao and Veria AI. RippleX, the group responsible for maintaining the ledger, has already shipped a patch. No evidence of exploitation was found, and the circulating supply remains at approximately 99.986 billion XRP.
Key details about the vulnerability
- The bug is an integer overflow, a type of error where a number exceeds its maximum limit and wraps around to near zero, similar to an old arcade game score counter resetting
- An attacker could have bypassed standard fund checks by manipulating transaction costs, crediting sellers their full XRP while paying only a fraction of a cent
- The flaw is believed to have existed since 2015
- The XRP Ledger was designed so no new tokens can ever be minted, with all 100 billion coins created at launch in 2012
How the exploit would have worked
The vulnerability could have been triggered by hundreds of carefully constructed transactions. An attacker would have set up dummy accounts to post fake token sales worth astronomical amounts of XRP, then acted as the buyer to purchase all tokens at once. The ledger would have credited the seller accounts with billions of valid XRP while registering a total cost of only a fraction of a cent due to the integer overflow. This would have effectively created billions in new XRP out of thin air.
Official statement from the XRP Ledger Foundation
The XRP Ledger Foundation explained in a post on X that normal parameters never triggered the bug. "The bug went unnoticed mainly because it required a massive scale of action to trigger," the foundation said in an explainer published Monday. The foundation confirmed no unauthorized XRP was created and no damage occurred.
What remains unclear
While RippleX confirmed the patch has been shipped and found no evidence of exploitation, the exact timeline of when the flaw was introduced into the codebase is not specified beyond the 2015 estimate.
Why this matters for XRP holders
The 100 billion supply cap is a foundational rule that XRP holders rely on. The fact that a flaw existed for over a decade without detection raises questions about how thoroughly blockchain protocols are tested, even on networks that have seen significant transaction volume over that time.
What happens next
RippleX has already patched the vulnerability. The foundation has not announced any further steps or additional security reviews.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.