Zcash

Read

would

A flaw present in the XRP Ledger payment engine since 2015 could have let an attacker mint spendable XRP<a href="https://yellow.com/asset/xrp" rel="noopener noreferrer nofollow">(XRP)</a> beyond its 100 billion supply cap, developers said.
<blockquote>
 <h2 id="key-points">Key Points:</h2>
 <ul>
 <li>A researcher using an AI security tool reported the overflow bug on Sept. 22 through the network's bug bounty program.</li>
 <li>Developers shipped a fix three days later, skipping the usual validator vote for the first time in over a decade.</li>
 <li>Maintainers found no evidence that anyone exploited the flaw.</li>
 </ul>
</blockquote>
<h2 id="xrp-counterfeiting-bug">XRP Counterfeiting Bug</h2>
XRP Ledger maintainers <a href="https://xrpl.org/blog/2026/vulnerabilitydisclosurereport-bug-20261009" rel="noopener noreferrer nofollow">disclosed</a> the flaw in a vulnerability report on Oct. 9, saying a researcher flagged it through the network's bug bounty program on Sept. 22. RippleX, the developer arm of Ripple, rated it critical after reproducing the attack. The team found no sign that anyone ever exploited it.
The overflow sat in the payment engine, which used unchecked 64-bit math to total what a buyer owed when a single payment filled many order book offers at once.
Hundreds of deliberately mispriced offers could push that total past its limit and wrap it around to a tiny number, so sellers got paid in full while the buyer paid almost nothing. The ledger's own safety check against new XRP used the same arithmetic, so it <a href="https://decrypt.co/380693/xrp-ledger-payment-engine-counterfeiting-bug-hiding" rel="noopener noreferrer nofollow">missed</a> the counterfeit coins entirely.
Also Read:<a href="https://yellow.com/news/gpt-6-1-sol-asana-agent-costs" rel="noopener noreferrer nofollow">GPT-6.1 Sol Helped Cut Asana’s Agent Costs 76 Times, But Here’s The Catch</a>
<h2 id="cayden-liao-explains">Cayden Liao Explains</h2>
Cayden Liao, security co-founder at Veria Labs, <a href="https://www.theblock.co/news/ecosystems/2026-10-11-xrp-ledger-patches-decade-old-bug-that-could-have-minted-trillions-of-xrp-418230" rel="noopener noreferrer nofollow">wrote</a> on X that the firm's AI agent found the bug and built a working exploit. By his count, one transaction could have minted about 18 trillion XRP. He suspects nobody caught it earlier because it "chains together two bugs that would be low severity on their own."
Liao said Ripple paid Veria the program's maximum $250,000 bounty. J. Ayo Akinyele, who leads engineering at RippleX, said the team would widen its use of AI-assisted bug hunting and formal verification, noting that AI is "fundamentally changing how quickly vulnerabilities can be discovered."
<h2 id="xrpl-emergency-patch">XRPL Emergency Patch</h2>
The fix shipped in xrpld version 3.4.1 on Sept. 25, three days after the report. More than 80% of trusted validators ran it that day, and the change took effect without the usual two-week amendment vote, a first in over a decade. Developers argued that releasing open-source code under the normal process would have shown attackers the bug for weeks before the patch kicked in.
In 2010, a Bitcoin<a href="https://yellow.com/asset/btc" rel="noopener noreferrer nofollow">(BTC)</a> overflow bug <a href="https://gizmodo.com/xrp-bug-could-have-let-hackers-print-billions-in-crypto-out-of-thin-air-2000824673" rel="noopener noreferrer nofollow">created</a> more than 184 billion coins in one transaction before developers fixed it within hours and forked the chain to erase them. Zcash<a href="https://yellow.com/asset/zec" rel="noopener noreferrer nofollow">(ZEC)</a> also rushed to patch a counterfeiting flaw this year, and the scare sent its token sharply lower.
Read Next:<a href="https://yellow.com/news/french-crypto-holders-10000-euro-fines" rel="noopener noreferrer nofollow">French Crypto Holders Could Owe Up To 10,000 Euros For Unreported Wallets</a>

XRP Ledger Hid A Coin-Minting Flaw Since 2015, Developers Now Reveal

Table of Contents

Yellow News

Other articles published on Oct 13, 2026

Join our free newsletter for daily crypto updates!