XRP Ledger Patches 2015 Bug That Could Have Minted Trillions of XRP in One Transaction
Overflow bug in payment engine stays hidden for a decade
XRP Ledger developers confirmed on Friday that a critical-severity bug in the network's payment engine could have let an attacker create XRP out of nothing. The flaw, which had been sitting in the code since 2015, involved a missing overflow check when the engine totaled payments that filled many order book offers at once. A large enough total could wrap around to a small number, bypassing the network's supply cap check.
Security firm Veria Labs found the bug, and Ripple shipped a fix in xrpld version 3.4.1 on September 25. The XRP Ledger disclosure report stated there was no evidence the vulnerability had been exploited on any public network.
What the bug and the fix involve
- The bug let an attacker create a single payment that filled hundreds of order book offers at once. Each seller would have been paid in full, while the buyer wallet would have been charged only a few hundred drops (the smallest XRP unit) plus a fee.
- The network's check against newly created XRP used the same flawed addition, so it would also fail to block the minting.
- The XRP Ledger's total supply is capped at 100 billion XRP, with supply shrinking slightly as transaction fees are burned. A single exploit transaction could have minted roughly 18 trillion XRP — about 184 times the total supply.
- The attack could not have triggered by accident. It required hundreds of offers priced in a way no real trader would use, followed by a payment built specifically to consume them all at once.
- Ripple also patched a separate bug in the Batch feature, which had not yet gone live. That flaw could have produced a permanently malformed record and break off-chain tools, though it gave an attacker nothing on-chain.
How the bug was found
Cayden Liao, security co-founder at Veria Labs, said his firm's AI agent discovered the vulnerability and built a working exploit. He reported the finding to Ripple on September 22, and the fix shipped three days later. Veria received the maximum $250,000 bounty from the program. Liao said that, to his knowledge, it was the largest bounty ever paid for a vulnerability discovered entirely by an AI agent.
Liao noted that the bug likely went unnoticed for so long because it chains together two flaws that would each be considered low severity on their own.
Why the fix skipped the usual amendment process
Rule changes on the XRP Ledger normally go through an amendment process requiring more than 80% support from the network's trusted validators over a period of two weeks. This fix took effect as each server upgraded, which the disclosure report said was a first in more than ten years of amendments.
The report explained that because xrpld is open source, a standard release would have shown attackers where the bug was for weeks before the fix activated. Over 80% of validators on the default Unique Node List were running the patched version on September 25.
Criticism over closed-source window
The source code for the 3.4.1 update was published roughly two weeks after the binaries. Cyber Capital founder Justin Bons criticized the delay, writing on X that XRP had been running closed-source code for two weeks.
RippleX engineer Mayukha Vadari responded that AI tools had changed the situation: a critical bug patch released through the normal public process could be spotted and reverse-engineered immediately. RippleX Head of Engineering J. Ayo Akinyele said the team would expand AI-assisted bug hunting and formal verification, adding that AI is fundamentally changing how quickly vulnerabilities can be discovered.
What is confirmed
- A critical overflow bug existed in the XRP Ledger payment engine since 2015.
- Veria Labs' AI agent discovered the bug and built a working exploit.
- Ripple fixed it in xrpld 3.4.1 on September 25, 2026.
- Ripple paid Veria the maximum $250,000 bounty.
- No evidence of exploitation exists on any public network, per the disclosure report.
- The fix activated without an amendment vote, a first in more than ten years.
What is still unclear
- Whether the vulnerability was privately exploited in any way before being reported. The report says no evidence of public exploitation, but that does not rule out isolated use.
- Why the bug went undetected for eleven years despite the XRP Ledger's active development.
- Whether other similar overflow issues remain in other parts of the XRP Ledger codebase.
Why this matters for crypto network security
The discovery illustrates how AI-assisted vulnerability research can surface flaws that have gone undetected for years, even on a network with a decade of operating history. It also raises a practical tension: keeping fix code private speeds up patching, but reducing transparency can be seen as a break from open-source norms. Ripple's engineers framed the decision as a necessary response to the speed at which AI tools can now analyze publicly released code.
Where things stand now
Over 80% of validators were running the patched xrpld 3.4.1 version as of September 25. Servers on older versions can no longer stay in sync with the network. The Batch feature and its fix both activated on October 9. Ripple's engineering team said it would expand AI-assisted bug hunting and formal verification efforts going forward.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.