Ripple Patches Flaw That Could Mint 18 Trillion XRP

The XRP Ledger Foundation and RippleX patched a critical integer-overflow vulnerability in the XRP Ledger (XRPL) that could have allowed the minting of 18 trillion XRP in a single transaction. The flaw, which is believed to have existed since 2015, would have enabled an attacker to bypass the cryptocurrency's 100 billion XRP supply cap by using hundreds of carefully constructed operations to wrap costs to near-zero values.

Researcher Cayden Liao and Veria AI discovered the flaw using an AI agent and reported it on September 22, 2026. The vulnerability was demonstrated on a local network by chaining two separate bugs. In response, the XRPL team released an emergency fix in xrpld version 3.4.1 on September 25. Ripple awarded the research team a $250,000 bounty for the discovery.

RippleX investigated the issue and found no evidence that the flaw was exploited in any live public environment before the patch was implemented. To prevent similar future vulnerabilities, the XRP Ledger Foundation plans to implement formal verification, strengthen its bug bounty program, and apply AI adversarial testing.