RippleX, Ripple’s engineering and software development team, has patched a critical vulnerability in the XRP Ledger (XRPL).
Notably, the flaw could have let attackers create about 18.45 trillion XRP in a single transaction, potentially breaching the network’s original 100 billion token supply cap.
Researchers from US-based cybersecurity startup Veria Labs discovered the flaw using an artificial intelligence-powered security agent, which developed a working exploit in a local test environment. The vulnerability had remained undetected in the XRPL’s payment-processing code since 2015.
In an October 12 report, the researchers warned that the flaw could have put XRP’s reported $94 billion market value at risk. The vulnerability involved an integer overflow in XRPL’s payment engine. When a transaction processed multiple decentralized exchange orders, the software could incorrectly calculate the total XRP required to settle them.
This allowed sellers to receive the full amounts associated with their orders while the buyer was charged substantially less. A second arithmetic error in the ledger’s supply-protection mechanism could then prevent the transaction from being rejected.
Veria Labs estimated that a single successful transaction could create more than 184 times XRPL’s original XRP supply. The researchers also said the attack could be repeated under the right conditions.
“An attacker could have created spendable XRP far beyond the total supply in a single validated transaction,” Veria Labs stated.
The firm reported the vulnerability on September 22, 2026. The fix was merged the following day, and the emergency software release, rippled 3.4.1, arrived on September 25.
The response bypassed XRPL’s standard amendment process, which generally requires support from more than 80% of trusted validators over two weeks.
For context, developers opted for an immediate software update because publishing the patch while waiting for the usual approval process could have exposed the vulnerability to attackers before the network was fully protected. The disclosure says more than 80% of default validators upgraded on release day.
The disclosure follows a separate August security incident in which an attacker stole approximately $200,000 from the tx XRPL cross-chain bridge. The attack involved software that incorrectly recognized transactions as deposits even though the corresponding XRP had not reached the bridge’s reserves.
The bridge operator subsequently halted the service and addressed the vulnerability.
That said, on Sunday XRPL developers announced plans to strengthen security testing through mandatory retesting of fixed vulnerabilities before releases and expanded AI-assisted bug detection.
“Together with RippleX and the community, we will ensure the XRP Ledger is protected against such vulnerabilities. This means radically applying Formal Verification and AI adversarial testing, collaborating closely with security researchers, and strengthening the bug bounty program.” They stated on X.