XRP Ledger patches critical bug that could have printed billions in coins

The network patched a bug on Friday. An integer overflow in the payment engine could have created fake XRP tokens. This would allow spending money that did not exist within the system's supply cap.

The flaw worked through a specific transaction method. One payment could consume many offers from the order book simultaneously. The system summed amounts using math without overflow checks, allowing totals to wrap around to tiny numbers.

An attacker would need hundreds of accounts with strange pricing to profit. They only needed a few hundred dollars in reserves and fees to start. The bug likely existed since the current payment engine was written in 2015.

Researcher Cayden Liao reported the issue on September 22nd. RippleX reproduced it on a test server before rating it critical. An emergency software update followed two days later to stop the risk.

This fix skipped the normal voting process for rule changes. Usually, validators must agree by more than 80% over two weeks for updates. The report notes this is the first time a transaction change shipped without a vote in ten years.

Officials argued a network halt was better than an incorrect ledger state. They risked splitting the network while servers upgraded to avoid exploit transactions. Most validators used closed-source binaries at the time.

Critics describe Ripple as a central operator in the crypto space. All 100 billion XRP were created before the company existed, with founders keeping 80 billion. The SEC sued in December 2020 and dropped appeals in August 2025 with a $125 million penalty.

This event joins other money-printing exploits in recent history. Bitcoin had a similar overflow bug in 2010 that created billions of coins briefly. A Liquid Network exploit last month let attackers cash out unbacked coins.

AI tools played a role in finding this vulnerability. Veria AI, developed by Liao's startup, helped identify the bug. Researchers say coding agents are superhuman at finding security holes.

Market prices remained stable after the disclosure. XRP did not move much compared to Zcash, which fell about 60% earlier this year. Security risks also include hardware wallets facing supply chain attacks recently.