QuantCapThe XRP Ledger Foundation said normal parameters never triggered the bug that could have broken XRP's supply cap, which is why it was undetected for years.
Why a bug that could have threatened XRP's 100 billion supply cap stayed hidden for years
The XRP Ledger Foundation said normal parameters never triggered the bug that could have broken XRP's supply cap, which is why it was undetected for years.
An XRP Ledger bug that went undiscovered for more than a decade could have allowed an attacker to create billions of XRP, undermining the cryptocurrency’s 100 billion token supply cap. The integer-overflow flaw required hundreds of carefully constructed transactions, allowing manipulated costs to wrap to a near-zero value while seller accounts received full payments. Researchers reported the vulnerability on Sept. 22, and RippleX patched it after finding no evidence of exploitation or unauthorized XRP creation on a public network.
A bug that could have let an attacker print new XRP (XRP) out of nothing sat in the XRP Ledger for more than a decade without anyone noticing because normal user activity never came close to triggering it, according to XRP Ledger Foundation.
The 11-year-old bug mattered because it threatened the core rule XRP holders rely on: that the total supply can never exceed the 100 billion coins created at the blockchain’s debut in 2012. It was uncovered Sept. 22 by researcher Cayden Liao and Veria AI and reported internally.
No damage was done, according to RippleX, which shipped the fix. No new XRP was created and about 99.986 billion XRP remain in circulation today, the foundation said.
The XRP Ledger (XRPL) is an open-source, decentralized layer-1 blockchain. Its native token, XRP, was built so that no new tokens can ever be minted. The coin is primarily used to pay transaction fees and bridge currency trades on the ledger's built-in decentralized exchange (DEX).
However, the bug, believed to have existed since 2015, provided a way around that, at least in theory.
Here’s how it could have worked
The bug stemmed from a vulnerability known as an “integer overflow,” which, like an old arcade game’s score counter, resets to zero every time it hits its maximum.
In the XRP Ledger case, the flaw meant that once a transaction size exceeded the system's maximum allowed numerical limit, the value wrapped around to a very small number. That bypassed standard fund checks, crediting sellers their full XRP amounts while charging buyers next to nothing, effectively minting the difference out of thin air and artificially inflating the total XRP supply.
An attacker could have set up dummy accounts to post fake token sales worth astronomical amounts of XRP. Then, acting as the buyer, the attacker could have paid in XRP, buying all tokens at once. The ledger would credit the seller accounts with billions of valid XRP and, overwhelmed by the sheer amount of XRP, would have registered a total cost of only a fraction of a cent for the buyer.
By bypassing standard fund checks, the system would effectively mint the difference out of thin air, allowing the attacker to walk away with billions of new XRP to liquidate on external exchanges.
Why it went unnoticed?
The bug went unnoticed mainly because it required a massive scale of action to trigger, the XRP Foundation said in an explainer published Monday.
“No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations,” it said.
The ledger’s own safeguards missed it too. As CoinDesk reported last week, the check that runs after every transaction to confirm no new XRP has appeared relied on the same miscounted total, so it saw nothing unusual. A separate limit on how much XRP a single account can receive didn’t trigger either, because the potential attack would have spread the XRP across hundreds of accounts.
The foundation noted that artificial intelligence is making it faster to find such flaws for both "the bad guys and the good guys." To ensure safety going forward, the foundation plans to aggressively apply AI adversarial testing, implement formal verification and strengthen its bug bounty program.
“You’ll hear a lot more about this as we progress,” it said.
1U.S. inflation, Ethereum upgrade talks: Crypto Week Ahead11 minutes ago 2Ledger says unauthorized implant found in at least one device sold by CryptoBilis1 hour ago 3Bitcoin shrugs off ETF outflows to trade above $84,000 as oil falls4 hours ago 4Everyone wants SCOTUS to take up prediction markets: State of Crypto 14 hours ago 5Clarity's failure could speed crypto innovation while shielding incumbents17 hours ago 6President Trump declares 'energy ceasefire' between Russia and Ukraine17 hours ago 7IMF finds demand for tokenized stocks, says the market is still volatile, illiquid20 hours ago 8One year after 10/10 flash crash, bitcoin and ether liquidity have rebuilt, but altcoins still face risks1 day ago 9Tokenized commodities look beyond gold as lending and oil open new markets1 day ago 10Bitcoin's $19 billion wake-up call: One-year after flash crash, has crypto learned anything?1 day ago
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Why it matters:
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Ledger says unauthorized implant found in at least one device sold by CryptoBilis
XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing
Zcash developers set January target for quantum-resistant payments after ‘bunker mode’ scare