- Developers found no evidence of exploitation on public networks.
- Veria estimated the flaw could create 18.45 trillion XRP per transaction.
- The emergency patch sparked debate over temporarily withheld source code.
An XRP Ledger security bug could have allowed attackers to create trillions of spendable tokens, developers disclosed on October 9. The flaw dated to 2015 and was patched on September 25. Developers found no evidence of public exploitation. The XRP Ledger Foundation also said on X that checks confirmed the public supply remained intact.
How the XRP Ledger security bug bypassed supply checks
Veria reported the flaw on September 22. RippleX reproduced the XRP Ledger security bug on a standalone server, confirming that newly created tokens could fund another payment.
In his October 10 X post, Veria Labs co-founder Cayden Liao credited the discovery to Veria AI. He estimated potential creation at about 18.45 trillion XRP per transaction, over 184 times the original supply. Liao also reported a $250,000 bounty.
The payment engine flaw involved integer overflow: an oversized total wrapped into a much smaller number. Sellers could receive full payments while buyers paid almost nothing. A supply safeguard repeated the arithmetic error, allowing unauthorized XRP minting.
The exploit required deliberately abnormal trading offers across hundreds of accounts. Ordinary payments could not trigger it, according to the disclosure, despite the long exposure period.
XRP Ledger security bug fix prompts transparency debate
Developers shipped xrpld 3.4.1 with compiled software before releasing its source code. Justin Bons criticized the temporary withholding on X.
RippleX engineer Mayukha Vadari replied that AI could quickly expose critical fixes within public releases. Publishing the patch before protection activated would have given attackers a window to exploit the XRP Ledger security bug.
The overflow fix applied immediately when servers upgraded, bypassing the usual amendment delay. More than 80% of default UNL validators upgraded on release day.
The Foundation said operators independently chose their software and coordinated the response through community agreement. It distinguished that emergency rollout from the later amendment vote that made upgrading necessary to remain synchronized.
A separate Batch fix activated through amendments on October 9. The Foundation also pledged broader formal verification, AI adversarial testing and researcher collaboration.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
