Cyber

XRP Ledger (XRPL) developers have defended an emergency security patch that skipped the network's standard validator vote. The fix, released on September 25, closed a flaw that could have allowed an attacker to create spendable <a href="https://x.com/search?q=%24XRP&amp;src=cashtag_click" rel="noopener noreferrer nofollow">$XRP</a> beyond the token's fixed supply.
According to the XRPL Foundation, the decision to bypass the normal process was made jointly by developers, RippleX (<a href="https://x.com/RippleXDev" rel="noopener noreferrer nofollow">@RippleXDev</a>) and validators. RippleX reported no evidence of exploitation on public networks.
<h2 id="why-the-patch-skipped-the-two-week-vote">Why the patch skipped the two-week vote</h2>
Cointelegraph reported that XRPL developers said they could not wait for the usual two-week validator vote without exposing the flaw to attackers. The fix came three days after a bug bounty report and took effect immediately on any server that installed it. Developers described it as the first deliberate bypass of the normal amendment process since the system was introduced more than ten years ago.
Under the standard route, rule changes normally need support from more than 80% of trusted validators for two weeks, according to BeInCrypto. In an X post, XRPL developers argued that a normal amendment vote would have made the fix public for weeks before it took effect, which risked network security.
<h2 id="what-the-bug-did-and-how-it-was-fixed">What the bug did and how it was fixed</h2>
The flaw was an integer overflow in the ledger's payment engine. Cryptometer reported that an attacker could have placed offers involving unusually large amounts of XRP across many accounts, then consumed them with a single crafted payment. The combined total could exceed what the counter could hold and wrap around to a much smaller number, so sellers would be paid in full while the buyer paid far less.
The issue reportedly dates to 2015 and was reported on September 22 by researchers Cayden Liao and Veria AI through the XRPL bug bounty program, per the same report. Digital Today reported that RippleX engineers reproduced the flaw on a local standalone server and confirmed the newly created XRP could be spent. The fix shipped in xrpld 3.4.1.
Uptake was fast. Coingape reported that more than 80% of default UNL validators were running the update by release day, with public disclosure following on October 9.
The move has drawn criticism. Cyber Capital founder Justin Bons argued that the release shipped as binaries only and pressured operators to upgrade, according to Cointelegraph. The Foundation responded that no single party could make the call alone, and that every validator and node operator chooses what software to run.
Sources:<a href="https://cointelegraph.com/news/xrp-ledger-defends-emergency-patch-for-unlimited-xrp-bug" rel="noopener noreferrer nofollow">Cointelegraph on the XRPL emergency patch</a>, <a href="https://beincrypto.com/xrp-ledger-bug-create-xrp-fixed/" rel="noopener noreferrer nofollow">BeInCrypto on the XRP Ledger bug fix</a>, <a href="https://www.digitaltoday.co.kr/en/view/112743/xrpl-bug-fixed-that-could-have-allowed-excess-xrp-minting-no-signs-of-exploitation" rel="noopener noreferrer nofollow">Digital Today on the XRPL bug and no signs of exploitation</a>

XRP Ledger Bypasses Normal Vote to Fix Unlimited XRP Bug

Table of Contents

BSCN

Other articles published on Oct 12, 2026

Strategy’s Next Bitcoin Buy May be Closer Than Expected

It's about to be a big week for Filecoin's filecoin:native ...

Hedera DEX volume grows +151%.

Injective's $INJ goes live for trading on X!

Binance fees: 0.1 percent to trade, and one drawback compared with MiCA-licensed exchanges

Spot Bitcoin ETFs Saw $681M in Net Outflows October 5–9

Join our free newsletter for daily crypto updates!