The team behind the XRP Ledger published a security report on 9 October 2026. It describes a bug in the ledger’s payment engine that, in the report’s words, “could be exploited to create XRP from nothing”. The fix shipped in a software release on 25 September, and the team says it has “found no evidence that this issue was exploited on any public network”.
Spotted via X News on X; primary sources are the XRP Ledger’s disclosure report [1] and release note [2].
What the disclosure says
Confirmed (XRPL’s own report). A researcher reported the flaw through the XRPL bug bounty programme on 22 September 2026. The report rated it Major. RippleX engineers, who build core XRP Ledger software, reproduced it and “raised the severity to critical” [1]. It affected xrpld 3.4.0 and earlier; xrpld is the ledger’s server software.
The report names the researchers as Cayden Liao and Veria AI [1]. CoinDesk, which reported the story on 10 October, says the same [3].
What an integer overflow is
Computers store whole numbers in a fixed amount of space, so there is a largest number they can hold. An integer overflow happens when a calculation goes past that limit. Instead of stopping with an error, the number wraps around, like a car odometer rolling from 999999 back to 000000.
Confirmed (XRPL’s own report). The payment engine added up amounts without checking for this. A total that was too big came out as a small number, so the books did not balance. A built-in check meant to confirm that no transaction creates XRP used the same kind of arithmetic, so it missed the problem too [1]. TSN does not repeat the report’s detailed technical steps.
“Since 2015”
The report says “investigation suggests that the bug had been present since the current payment engine was written in 2015” [1]. That is the team’s assessment. CoinDesk says the bug is “believed to date to 2015” [3].
The fix, and why there was no amendment vote
Confirmed. The fix “shipped in xrpld 3.4.1, released on 2026-09-25”, which the release note calls an “emergency release” [1][2]. More than 80 percent of validators on the default trusted list were running it that day, the report says [1].
An amendment is how the XRP Ledger normally changes its rules. The new rule ships in the software but stays switched off until more than 80 percent of trusted validators have supported it for two weeks. Then every server switches at the same moment [1].
The overflow fix did not go through that process. It took effect on each server as soon as it upgraded. The report says this is the first time a change to transaction processing has deliberately shipped that way since amendments began more than ten years ago. Its reasoning: open-source code that fixes a bug also shows where it is, so weeks of waiting would have left a known flaw open [1]. The source code was published only on 9 October [1].
Where fixBatchV1_2 fits
The amendment named in the release, fixBatchV1_2, “became enabled on Mainnet on 2026-10-09” [1]. It is a different fix, for a separate bug in the Batch feature, which had not been switched on for Mainnet, and the report says no funds were affected [1]. Servers not on 3.4.1 or newer are now “amendment blocked” and cannot stay in sync [1].
The Bottom Line
The XRP Ledger team confirms a serious bug, a fix released on 25 September and no evidence of exploitation. The “since 2015” age is its own estimate. TSN has not seen an independent check of those claims. This is not investment advice.
Related on TSN: Two Blockchain Upgrades: XRP Ledger Delegation and Solana’s 200ms Blocks Go Live
Sources
- XRP Ledger / RippleX, “Vulnerability Disclosure Report for xrpld 3.4.1”, xrpl.org, 9 October 2026 (primary source, read in full). https://xrpl.org/blog/2026/vulnerabilitydisclosurereport-bug-20261009
- XRP Ledger, “Introducing XRP Ledger version 3.4.1”, xrpl.org, 25 September 2026 (primary source). https://xrpl.org/blog/2026/xrpld-3.4.1
- Shaurya Malwa, “XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing”, CoinDesk, 10 October 2026 (secondary report; TSN does not repeat its “billions of dollars” headline). https://www.coindesk.com/tech/2026/10/10/xrp-ledger-patched-decade-old-bug-that-could-create-billions-of-dollars-in-xrp-from-nothing
- X News on X, trending-news page “XRP Ledger Fixes Decade-Old Bug That Could Create Tokens From Nothing” (an X trending-news page that summarises posts, not an individual post; confirmed to exist via the X API, 10 October 2026; used for discovery only, no figures taken from it). https://x.com/i/trending/2108795799232802867
