An XRP Ledger vulnerability that remained concealed for more than ten years could have enabled a malicious actor to generate billions of XRP, undermining the digital asset’s strict limit of 100 billion tokens.
This integer-overflow flaw demanded hundreds of meticulously engineered transactions, permitting manipulated costs to wrap around to a near-zero figure while the accounts belonging to sellers received full disbursements.
Investigators disclosed the security flaw on September 22, and RippleX deployed a patch after confirming there was no indication of exploitation or unauthorized token generation on any public network.
A defect that could have permitted a bad actor to mint new XRP out of thin air persisted within the XRP Ledger for more than a decade without detection simply because standard user operations never approached the scale required to activate it, according to statements from the XRP Ledger Foundation.
This eleven-year-old flaw was significant because it endangered the foundational guarantee that XRP participants depend on: the absolute certainty that the circulating amount will never surpass the 100 billion units established at the blockchain’s launch in 2012. Researcher Cayden Liao alongside Veria AI discovered the issue on September 22 and reported it internally.
RippleX confirmed that no harm occurred and deployed the remediation update, noting that no unauthorized coins were minted and roughly 99.986 billion XRP remain actively circulating today.
The XRP Ledger operates as an open-source, decentralized layer-1 blockchain network. Its native cryptocurrency, XRP, was engineered so that no additional tokens can ever be created. The asset is utilized primarily for settling transaction costs and facilitating currency exchanges across the platform’s integrated decentralized exchange.
Nevertheless, this glitch, believed to have been present since 2015, established a theoretical workaround to those safeguards.
Here’s how it could have worked
The issue originated from a vulnerability known as an integer overflow, which functions similarly to an old arcade game’s score tally by resetting to zero immediately upon reaching its peak numerical threshold.
Within the context of the XRP Ledger, this meant that once a transaction volume surpassed the platform’s maximum permitted numerical constraint, the calculated value wrapped around to an extremely small digit. This behavior bypassed standard balance verifications, crediting merchants with their complete XRP sums while debiting purchasers almost nothing, effectively creating the difference out of thin air and artificially expanding the aggregate XRP supply.
A malicious actor could have established secondary wallets to publish fraudulent token sales valued at massive quantities of XRP. Subsequently, acting as the buyer, the individual could have paid in XRP to acquire every listed token simultaneously. The ledger would have credited the merchant wallets with billions of legitimate tokens and, overwhelmed by the sheer scale, registered a total expense of merely a fraction of a cent for the purchaser.
By evading routine balance validations, the architecture would have effectively printed the discrepancy from nothing, granting the perpetrator billions of freshly minted tokens to liquidate on external trading venues.
Why it went unnoticed?
The defect avoided detection primarily because it demanded a vast operational scale to trigger, as outlined by the XRP Foundation in an advisory published on Monday.
No standard transfer approaches the thresholds needed to activate it, requiring hundreds of deliberately orchestrated operations instead.
The platform’s internal defenses also failed to flag the anomaly. As CoinDesk reported previously, the verification routine executing after every transaction to ensure no new coins had materialized depended on the same flawed aggregate calculation, leading it to register normal behavior. Furthermore, an independent restriction regarding the maximum volume of XRP a solitary address can accept failed to trigger because the theoretical attack would have distributed the assets across hundreds of distinct wallets.
The foundation emphasized that artificial intelligence is accelerating the discovery of such weaknesses for both malicious actors and defenders alike. To guarantee ongoing security, the organization intends to aggressively deploy AI-driven adversarial testing, adopt formal verification methods, and enhance its vulnerability rewards initiative.
Participants will hear significantly more regarding these initiatives as development continues.
Originally published at https://www.coindesk.com/tech/2026/10/12/why-a-bug-that-could-have-threatened-xrp-s-100-billion-supply-cap-stayed-hidden-for-years.
