- XRPL confirmed no additional XRP was created, with no evidence of exploitation on public networks.
- Developers fixed the payment flaw in xrpld 3.4.1 on September 25, bypassing normal amendment activation.
- XRPL plans AI-assisted testing, formal verification, and expanded bug bounty efforts.
The XRP Ledger Foundation said no additional XRP was created through a critical vulnerability that could have allowed attackers to generate and spend tokens without paying the required amount. Developers fixed the flaw in the September 25 release of xrpld version 3.4.1, with no evidence of exploitation on public networks.
The foundation said the network’s supply remains capped at 100 billion XRP, with approximately 99.986 billion tokens currently in existence, and outlined plans to strengthen security testing following the discovery.
In an October 2026 statement, the foundation addressed questions about the vulnerability, the decision to release a direct software fix, and the role of validators in protecting the network. The disclosure follows the September 25 release of xrpld version 3.4.1, which addressed the payment-engine flaw.
XRP Ledger Foundation Says No New XRP Was Created
The breach could have bypassed the XRP Ledger’s rule against creating additional tokens. According to the security disclosure, an attacker could construct hundreds of unusually priced offers across multiple accounts and cause an integer overflow through a single payment.
The payment engine could then credit sellers with their full XRP amounts while charging the buyer only a much smaller amount. Because an existing supply-protection check relied on similar arithmetic, it could fail to detect the discrepancy.
Researchers Cayden Liao and Veria AI reported the issue through the XRP Ledger’s bug bounty program on September 22. RippleX engineers reproduced the exploit in a controlled environment and confirmed that the resulting XRP could be spent in another transaction.
The foundation said that all ledger data is publicly accessible, and account balances can be verified on blockchain explorers and other data services. It also said it had monitored and verified the network’s supply throughout its history and found no evidence that the vulnerability had been exploited on a public network.
Emergency Patch Bypassed the Usual Activation Timeline
The September 25 release addressed the vulnerability without waiting for the standard amendment activation process. The foundation explained that a conventional amendment vote would have left the fix publicly known for weeks before taking effect, possibly giving attackers time to exploit the flaw.
The foundation, RippleX, core developers, and validators agreed on a response that allowed operators to upgrade directly to version 3.4.1. Developers shared the build with default Unique Node List validators before making public binaries available on September 25.
In addition, the foundation pointed out that no single organization could make the decision alone. Validators and node operators retain control over the software they run, while protocol changes continue to follow the amendment process.
The XRP Ledger also addressed a separate Batch transaction-validation vulnerability through the fixBatchV1_2 amendment, which took effect on October 9. That flaw had raised concerns about disagreements between software versions, but the affected Batch functionality had not been activated on Mainnet when the issue was discovered.
XRP Ledger Foundation Plans AI-Assisted Security Testing
The XRP Ledger Foundation also outlined plans to strengthen security through AI-assisted adversarial testing, formal verification, and closer collaboration with security researchers. The measures aim to identify potential vulnerabilities earlier and improve the network’s resilience.
The Foundation also plans to expand its bug bounty efforts to encourage researchers to identify and responsibly disclose flaws. These initiatives form part of its broader security response following the discovery of the XRP payment-engine vulnerability.
Bug Bounty Payment Draws Criticism
Blockchain investigator ZachXBT criticized the reported $250K payment to the white-hat researcher who identified the critical XRP creation vulnerability. He questioned the amount relative to Ripple’s reported treasury resources and argued that the payment could discourage future responsible disclosures.
Bill Morgan, meanwhile, responded to the criticism, comparing the XRP Ledger to Roman concrete that becomes stronger through testing. He also criticized those focusing on the vulnerability despite the flaw being fixed before any exploitation was reported on public networks.
Related: XRP Ledger Fixes Exploit That Could Create and Spend XRP Without Payment
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
