A hidden flaw in the XRP Ledger left the door open for a single transaction to mint 18 trillion XRP, threatening the network's capped supply and $94 billion market value. Developers skipped standard governance to push an urgent fix.
Veria Labs' AI agent caught a bug in the XRP Ledger's code that could have let an attacker mint 18 trillion XRP in one go. That's more than 180 times the network's intended supply. The discovery forced developers to sidestep the usual amendment process and rush out a patch, aiming to head off a crisis of confidence in the token's value.
The AI system dug through the open-source code and flagged a vulnerability in the payment engine. Veria Labs reported the issue on September 22. RippleX confirmed the risk: a single payment could have created trillions of new XRP, putting the network's fixed-supply model and $94 billion market cap on the line. The team patched the bug within three days. RippleX said no unauthorized XRP was minted and no funds were lost. The fix landed in server version 3.4.1 on September 25, 2026. Technical details went public on October 9, after the network was secured. RippleX stressed there was no sign of exploitation on the public ledger, as covered in the CoinDesk report.
The vulnerability existed in the XRP Ledger payment engine code since around 2015 and was linked to an overflow when summing XRP amounts across multiple decentralized exchange orders.
Normally, any change to the XRP Ledger's transaction rules needs two weeks of validator approval. This time, developers worked with the XRP Ledger Foundation and validators to push the fix immediately on servers running 3.4.1. They shipped binaries first and held back the source code to keep attackers from reverse-engineering the exploit before the network was safe. It was the first time in over ten years that the amendment process was skipped for a transaction rule change. The patch went out as a direct server update, not through the usual voting mechanism, to cut the window for possible attacks during rollout.
The AI flagged two weak spots in the payment engine. One was an integer overflow bug that could be triggered by carefully crafted trading offers. The system would miscalculate the amount owed, letting sellers get full payment while buyers paid only a fraction. That gap meant new XRP could appear out of nowhere. The second flaw hit the supply-protection check, which used the same faulty math and could miss the creation of unauthorized tokens. To pull off the attack, someone would need to set up hundreds of accounts and trading offers. The cost? Just a few hundred XRP in refundable reserves and standard fees. Reports show the attack path: create multiple accounts, place special orders, then use a single payment to trigger the bug.
The payment engine code dated to 2015. The supply safeguard arrived in 2017. Despite more than a dozen audits, security contests, and over $1 million in bug bounties since 2024, the combined flaw stayed hidden until Veria's AI built a working exploit and ran it on a local network. RippleX engineers confirmed the exploit and paid Veria Labs the top $250,000 bounty-the largest known reward for a vulnerability found entirely by AI. The bug was reported through the bounty program on September 22, 2026, with a proof-of-concept. RippleX shipped the patch three days later.
By September 25, over 80% of validators on the Default UNL had adopted the 3.4.1 patch, ensuring rapid network-wide protection before public disclosure of the technical details. This swift upgrade helped prevent consensus failures and maintained network stability during the emergency response.
Rolling out the emergency fix without the standard process brought its own risks. Servers running different versions could have disagreed on which transactions were valid, risking consensus breakdown or a network halt. Developers decided a short-term network hiccup was better than letting fake XRP slip into circulation. By September 25, more than 80% of validators on the default trusted list had upgraded, cutting the risk of consensus failure. Version 3.4.1 became the new baseline for network participation.
The incident pushed RippleX to rethink its security playbook, especially for old code that's survived multiple audits. The team plans to ramp up AI-driven vulnerability hunting and step up adversarial testing. Formal verification of key components like the payment engine and consensus logic is now a priority. RippleX also set a new rule: every previously fixed security issue must be retested against release candidates before being closed for good.
The XRP Ledger's hard cap of 100 billion tokens is central for users and investors. As earlier reports show, real liquidity and access can differ from headline supply, making airtight supply controls crucial. The recent bug shows that even networks with long audit trails can hide deep flaws, especially as AI tools get better at spotting complex, layered bugs that slip past human review.
Veria Labs calculated the bug could have created about 18 trillion XRP in one transaction-180 times the intended supply. The ledger's market cap stood at $94 billion at the time. The emergency patch went live on September 25, with public disclosure on October 9. RippleX's bug bounty program has paid out over $1 million so far, with the $250,000 award for this case marking its biggest single payout for an AI-found bug.
Supply controls underpin the credibility of any capped cryptocurrency. When hidden code flaws threaten those controls, the risk hits both technical stability and market trust. The XRP Ledger case shows that even with audits and bounties, legacy code can hide vulnerabilities that only advanced tools-or attackers-may find. As AI-driven security checks become standard, protocol teams will have to adapt their review and governance to keep up with both the new risks and opportunities these systems bring.
