{"id":79323,"date":"2026-10-10T09:03:43","date_gmt":"2026-10-10T09:03:43","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/a-decade-old-xrp-ledger-bug-could-have-minted-xrp-out-of-thin-air\/"},"modified":"2026-10-10T09:03:43","modified_gmt":"2026-10-10T09:03:43","slug":"a-decade-old-xrp-ledger-bug-could-have-minted-xrp-out-of-thin-air","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/a-decade-old-xrp-ledger-bug-could-have-minted-xrp-out-of-thin-air\/","title":{"rendered":"A Decade-Old XRP Ledger Bug Could Have Minted XRP Out of Thin Air"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Cayden Liao and Veria AI initially reported the XRPL overflow bug through the bug bounty program on Sept. 22, 2026.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">RippleX rated the flaw critical, and over 80% of default UNL validators ran the xrpld 3.4.1 fix by Sept. 25.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">The XRPL disclosure on Oct. 9 found no exploit, as the fixBatchV1_2 amendment went live the same day.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>What Was Actually Broken?<\/h2>\n<p>The problem sat inside the code that settles payments across the XRP Ledger\u2019s built-in decentralized exchange (DEX). According to the official <a href=\"https:\/\/xrpl.org\/blog\/2026\/vulnerabilitydisclosurereport-bug-20261009\" target=\"_blank\" rel=\"noopener noreferrer\">vulnerability disclosure report<\/a> published yesterday, when a single payment consumed many offers, the engine added up the amounts using unchecked 64-bit arithmetic.<\/p>\n<p>By pushing that sum high enough, it \u201cwrapped around,\u201d which is what an integer overflow does. A gigantic number subsequently became a small one and the sellers on the other side of the trade were paid in full, but the buyer was only charged the wrapped, tiny total. The difference was XRP that never existed before.<\/p>\n<p>The ledger does run a safety check, known as an invariant, that is supposed to confirm no XRP is ever created. That check used the same unchecked math, so it was blind to the exact failure it was built to catch. The report traces the flaw back to the current payment engine, which was written in 2015.<\/p>\n<h2>How Cheap Would an Attack Have Been?<\/h2>\n<p>The report says the cost was a few hundred XRP locked up as reserves, which are returned once the objects are removed, plus ordinary transaction fees. An attacker would have needed to place hundreds of deliberately mispriced offers and then route one payment through them.<\/p>\n<p>The payoff was the scary part, with RippleX calling the bug critical because spendable XRP could have been created beyond the total supply in a single validated transaction. XRP\u2019s whole pitch rests on a hard cap of 100 billion tokens, so a silent mint would have hit the asset\u2019s core promise. That is why posts such as one from Whale Insider framed it as a bug that <a href=\"https:\/\/x.com\/WhaleInsider\/status\/2108781536338145677\" target=\"_blank\" rel=\"noopener noreferrer\">could have conjured \u201cbillions\u201d of XRP<\/a>.<\/p>\n<h2>Who Found It and How Fast Was It Fixed?<\/h2>\n<p>The timeline was quite brief and as follows:<\/p>\n<ul>\n<li style=\"font-weight:400\" aria-level=\"1\"><b>Sept. 22:<\/b> Cayden Liao and Veria AI submitted their findings through the XRPL Bug Bounty program, rating it \u201cMajor.\u201d<\/li>\n<li style=\"font-weight:400\" aria-level=\"1\"><b>Sept. 23:<\/b> RippleX reproduced it, upgraded it to critical, and the fix was merged.<\/li>\n<li style=\"font-weight:400\" aria-level=\"1\"><b>Sept. 25:<\/b> Xrpld 3.4.1 was shipped, and more than 80% of default Unique Node List (UNL) validators were running it that day.<\/li>\n<li style=\"font-weight:400\" aria-level=\"1\"><b>Oct. 9:<\/b> Public disclosure.<\/li>\n<\/ul>\n<p>The patch did not go through the usual amendment vote but was instead shipped as a <a href=\"https:\/\/github.com\/XRPLF\/rippled\/releases\/tag\/3.4.1\" target=\"_blank\" rel=\"noopener noreferrer\">direct code change in release 3.4.1<\/a> and took effect as each server upgraded. Source code was only published after deployment, a standard move to avoid handing attackers a map. The <a href=\"https:\/\/x.com\/XRPLOperations\/status\/2108718741714510149\" target=\"_blank\" rel=\"noopener noreferrer\">XRPL Operations account<\/a> has since made 3.4.1 the minimum required version, adding:<\/p>\n<blockquote>\n<p>We have found no evidence that this issue was exploited on any public network.<\/p>\n<\/blockquote>\n<p>A second, lower-severity bug was fixed in the same release. It involved how Batch transactions are wrapped, and its fix sits behind the fixBatchV1_2 amendment, which went live on Mainnet on Oct. 9 alongside BatchV1_1. The report says no funds were lost from that one either.<\/p>\n<p>The disclosure landed in an ugly week for crypto security as Ledger device losses, which Bitcoin.com News reported, reached <a href=\"https:\/\/news.bitcoin.com\/security\/ledger-wallet-mystery-deepens-as-suspected-losses-hit-93-4m\/\">an estimated $93.4M.<\/a> Lastly, Ripple-backed Evernorth is preparing to start trading on Nasdaq under XRPN on Monday, with roughly <a href=\"https:\/\/x.com\/coinbureau\/status\/2108743066203111533\" target=\"_blank\" rel=\"noopener noreferrer\">473 million XRP<\/a> on its books. XRP has also been expanding into decentralized finance (DeFi), with Firelight recently <a href=\"https:\/\/news.bitcoin.com\/featured\/xrp-expands-defi-role-as-firelight-activates-vault-protection\/\">activating vault protection<\/a> on the network.<\/p>\n<div class=\"not-prose my-3 lg:my-4\">\n<div class=\"overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] hidden md:flex md:flex-row md:gap-3 lg:hidden\"><a aria-hidden=\"true\" tabindex=\"-1\" class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\" href=\"https:\/\/news.bitcoin.com\/ripple-24m-xrp-debt-fight-400m-tranglo-stake\/\"><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<p><\/a><\/div>\n<div class=\"overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] hidden lg:flex lg:flex-row lg:gap-4\"><a aria-hidden=\"true\" tabindex=\"-1\" class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\" href=\"https:\/\/news.bitcoin.com\/ripple-24m-xrp-debt-fight-400m-tranglo-stake\/\"><img alt=\"Ripple\u2019s $24M XRP Debt Fight Puts a $400M Tranglo Stake on the Block\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F10%2Fripple-1-150x150.jpg&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<p><\/a><\/p>\n<div class=\"flex min-w-0 flex-1 flex-col justify-center gap-2\">\n<p class=\"m-0 line-clamp-2 text-base leading-[1.3] !text-[#67656E]\">A Malaysian court has given Ripple a charging order over Seamless Group&#8217;s 60% stake in Tranglo, a holding priced at\u2026<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/featured\/xrp-ledger-bug-minted-xrp-overflow\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Cayden Liao and Veria AI initially reported the XRPL overflow bug through the bug bounty program on Sept. 22, 2026. RippleX rated the flaw critical, and over 80% of default UNL validators ran the xrpld 3.4.1 fix by Sept. 25. The XRPL disclosure on Oct. 9 [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":79324,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/79323"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=79323"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/79323\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/79324"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=79323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=79323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=79323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}