XRP Ledger Defends Emergency Patch That Bypassed Its Normal Two-Week Vote

Emergency patch closes a bug that could have created XRP beyond the network's fixed supply

XRP Ledger developers have pushed back against claims that an emergency security patch was forced on network operators without due process. The patch, released on September 25, fixed a bug capable of minting XRP beyond the network's fixed supply limit. It took effect immediately on any server that installed it, skipping the network's usual two-week amendment vote that requires more than 80% validator support.

According to XRPL developers, this was the first deliberate bypass of the normal amendment process since the system was introduced more than ten years ago. They said waiting for the standard vote would have left the vulnerability public for weeks, giving attackers time to exploit it.

The bug was an integer overflow in the ledger's payment engine that had existed since 2015. XRP balances are stored as 64-bit integers with a fixed maximum. When a sum exceeded that maximum, the calculation wrapped to a smaller number instead of failing. An attacker could exploit this by creating hundreds of specially priced offers and sending one payment that consumed them all. The engine would credit each offer owner their full amount but charge the buyer only the tiny wrapped total, with the difference becoming newly created, spendable XRP.

Developers said they found no evidence that the issue was exploited on any public network, and that the attack required deliberately constructed offers rather than normal trading activity.

Key points

• The emergency patch was released on September 25, three days after a bug bounty report filed the vulnerability.
• The bug was an integer overflow in the payment engine, present since 2015, that could have allowed an attacker to create unlimited XRP.
• This was the first deliberate bypass of the normal amendment process in more than ten years.
• XRPL Foundation says no single party made the decision to skip the vote; the decision involved the Foundation, RippleX, core developers, and validators jointly.
• No evidence was found that the bug was ever exploited on a public network.

What the XRPL developers said

XRPL developers posted on X (formerly Twitter) on Sunday that a normal amendment vote would have made the fix public for weeks before it took effect, risking network security. They emphasized that version 3.4.1 of the software only became mandatory after going through a normal amendment vote with more than 80% validator support sustained for two weeks, and that protocol changes still require amendments.

The Foundation also said every validator and node operator independently chooses what software to run on their machines.

What critics claim

Justin Bons, founder of Cyber Capital, posted on X on Thursday that marketing XRP to retail investors as a decentralized asset amounts to "straight-up fraud." He argued that the September 25 emergency release shipped as binaries only, temporarily withheld the source code, and pressured operators to upgrade quickly.

XRPL's website describes the ledger as a fully decentralized, public blockchain — a characterization that has been central to arguments that XRP is not a security regulated under U.S. securities law.

XRP Kuwait, an independent validator operator, rejected the idea that coordinated upgrades prove centralized control. The operator said that independent operators can assess a situation, communicate with each other, and reach the same conclusion without giving up their independence.

What is confirmed

• The bug was real and was an integer overflow in the payment engine present since 2015.
• The emergency patch was released on September 25, 2026.
• The normal two-week amendment process was bypassed for the first time since the system was created.
• No public network exploitation of the bug has been confirmed.

What is still unclear

• There is disagreement about whether the emergency patch represents centralized control or a legitimate security response. XRPL and independent validators say coordination does not equal control; critics point to the binary-only release and source code withholding as evidence of centralized influence.
• The question of whether the bypass is inconsistent with XRPL's own description of itself as a fully decentralized blockchain has not been resolved by the sources reviewed.

Why this matters

The incident raises questions about how XRP Ledger handles serious vulnerabilities in practice versus how it describes itself in principle. If network operators feel pressured to adopt patches outside the normal amendment process, it may weaken the case that the ledger operates without centralized decision-making. That matters because XRP's regulatory standing in the United States has been partially argued on the basis that the underlying network is sufficiently decentralized that XRP is not a security.

At the same time, the sources reviewed do not confirm that the bypass was forced on operators or that it was a unilateral decision. Multiple groups were reportedly involved in the decision, and the amendment vote for version 3.4.1 still went through the normal process after the emergency fix.

Sources

• Cointelegraph