Key takeaways

  • The XRP Ledger (XRPL) released xrpld version 3.4.1 on September 25 after developers discovered a critical vulnerability that could have allowed attackers to create approximately 18.5 trillion spendable XRP in a theoretical exploit scenario.
  • The potential amount vastly exceeded the network’s original 100 billion XRP supply, and Veria estimated the theoretical exposure at about $94 billion.
  • The bug was confirmed on September 22, the fix was merged on September 23, and RippleX found no evidence that the vulnerability had been exploited on a public network.

What happened

The emergency security patch addressed a payment-engine overflow that could have undermined the ledger’s XRP supply safeguards. Rather than wait for the network’s standard amendment process, which normally requires validators to vote on protocol changes before activation, developers released the patch directly. The XRPL Foundation’s vulnerability disclosure report described the payment-engine overflow and the decision to ship without waiting for the usual amendment route.

BSCN (@BSCNews) reported on October 12, 2026 that developers had defended the September 25 patch and described the vulnerability as allowing hackers to mint an infinite amount of spendable ripple:native. The reported timeline was compressed: confirmation came on September 22, the fix was merged the following day, and xrpld 3.4.1 was released on September 25.

The direct release reflected the severity of the flaw. Waiting two weeks for the regular process could have given attackers more time to exploit the vulnerability, particularly if publicly available code revealed how the exploit worked. For this fix, publishing the code ahead of activation could have shown attackers how to exploit the still-vulnerable network. Developers instead made the patch effective on each server as it upgraded.

Market context

The bypass was not a governance default. Under XRPL’s usual process, validators vote on transaction-processing changes over several weeks before a new rule activates, providing a coordinated transition across the network. Pending XRPL amendments illustrate how protocol changes ordinarily progress through validator support. The fix did not establish a new normal for XRPL governance; it was an emergency response to a vulnerability that, if exploited, could have created spendable XRP at a scale far beyond the original supply.

That emergency route carried a trade-off. Servers running different software versions could process the same exploit transaction differently while validators were upgraded. According to Veria, more than 80% of validators had upgraded by September 25, reducing the period of exposure. Veria’s proof of concept used specially priced offers and spread the resulting XRP across multiple accounts, keeping each account below the ledger’s individual balance limit. The firm estimated the theoretical exposure at about $94 billion.

The source material from Cryptonews presented the episode as a supply-integrity incident rather than a market-price event. The page included labels for XRP price views across 24 hours, 7 days, 30 days, 1 year and all time, but no price values were supplied.

Why it matters

The episode shows how dormant code paths can persist in established blockchain software. According to Veria, the vulnerable BookStep aggregation code dated back to 2015, while the XRPNotCreated invariant had been present since 2017. Both code paths had remained in the software for years before the vulnerability was identified. For a ledger whose supply safeguards depend on invariant enforcement, a payment-engine overflow is not a minor accounting bug; it touches the core monetary constraint represented by the 100 billion XRP supply.

The discovery also raises questions about the growing role of artificial intelligence in cybersecurity. AI-assisted tools can help researchers uncover dormant vulnerabilities in established software, but they can also lower the effort required for attackers to identify exploitable weaknesses. The theoretical 18.5 trillion XRP figure illustrates the vulnerability’s potential scale, but it does not mean those tokens were actually minted. RippleX found no evidence of exploitation on a public network.

The deeper issue is governance credibility. An emergency patch can reduce immediate risk, but bypassing validator voting changes the usual sequence for protocol changes. The source leaves an unresolved question: how should decentralized networks balance emergency security responses with transparent, validator-driven governance?

What to watch

The useful signals are narrower than the headline risk. First, whether future emergency patches are accompanied by more complete vulnerability disclosures, including the conditions under which direct releases become necessary. The XRPL Foundation report and Veria’s analysis provide the current baseline. Second, validator upgrade coverage during the window between patch release and full network adoption. More than 80% upgraded by September 25, but servers running different versions could still process exploit transactions differently.

Third, whether the ecosystem treats this as a one-time exception or a precedent for skipping amendment votes. The source is explicit that the fix did not establish a new normal. The remaining uncertainty is not whether XRP supply was inflated, because no public exploitation was found, but how decentralized networks will manage the tension between rapid containment and coordinated governance in future incidents.