{ "version": 1, "event_id": "evt_5e0ff89b9b3aed1e", "url": "https://xiyu.news/events/evt_5e0ff89b9b3aed1e/", "json": "https://xiyu.news/api/events/evt_5e0ff89b9b3aed1e.json", "type": "security_incident", "status": "closed", "category": "crypto", "title": { "zh": "XRP Ledger 披露并修复可无限铸造 XRP 的支付路径漏洞", "en": "XRP Ledger patched old flaw that could create XRP from nothing" }, "current_state": { "zh": "XRP Ledger 已披露并修复支付引擎中的整数溢出漏洞，该漏洞自 2015 年起潜伏且普通支付不会触发；3.4.1 补丁于 9 月 25 日发布，超过 80% 可信验证者当日已运行该补丁；无证据表明漏洞曾被利用。", "en": "The XRP Ledger disclosed and patched an integer overflow in the payment engine that had been dormant since 2015 and is not triggered by normal payments; the 3.4.1 fix shipped on Sept. 25, and more than 80% of trusted validators were running it that day; there is no evidence the bug was ever exploited." }, "first_seen_at": "2026-10-10T06:40:40.291436+00:00", "last_updated_at": "2026-10-12T16:21:16.629913+00:00", "last_material_change_at": "2026-10-12T16:21:16.629913+00:00", "confidence": 0.75, "updates_count": 8, "sources_count": 13, "entities": [ "bug", "could", "counterfeiting", "created", "critical", "emergency-patch", "engine", "had", "have", "hiding", "ledger", "payment", "reveals", "since", "supply-cap", "that", "unlimited", "why", "xrp", "xrp-ledger" ], "identifiers": [], "topics": [ "ai-security", "ai-security-agent", "blockchain-security", "bug-bounty", "bug-disclosure", "crypto-protocols", "decentralization", "emergency-patch", "integer-overflow", "patch", "protocol-bug", "protocol-exploit", "protocol-patch", "protocol-security", "protocol-upgrade", "protocol-vulnerability", "ripple", "supply-cap", "vulnerability-disclosure", "xrp", "xrp-ledger" ], "updates": [ { "update_id": "upd_e07da4e5ead2f143", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-10T04:24:02Z", "published_at": "2026-10-10T04:24:02Z", "first_seen_at": "2026-10-10T06:40:40.291436Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "XRP Ledger修复存在近11年重大漏洞，攻击者曾可利用其凭空生成XRP", "title_en": "XRP Ledger修复存在近11年重大漏洞，攻击者曾可利用其凭空生成XRP", "what_changed_zh": "XRP Ledger 开发者披露了一个可追溯至 2015 年的严重支付路径漏洞，该漏洞可能让攻击者铸造并花费超出 1000 亿供应上限的 XRP，他们已在 xrpld 3.4.1 中复现并修复了该漏洞，且没有证据表明其在真实环境中被利用。", "what_changed_en": "XRP Ledger developers disclosed a critical payment-path vulnerability dating to 2015 that could have let attackers mint and spend XRP beyond the 100 billion supply cap, which they reproduced and fixed in xrpld 3.4.1 with no evidence of exploitation in the wild.", "current_state_zh": "XRP Ledger 开发者披露了一个可追溯至 2015 年的严重支付路径漏洞，该漏洞可能让攻击者铸造并花费超出 1000 亿供应上限的 XRP，他们已在 xrpld 3.4.1 中复现并修复了该漏洞，且没有证据表明其在真实环境中被利用。", "current_state_en": "XRP Ledger developers disclosed a critical payment-path vulnerability dating to 2015 that could have let attackers mint and spend XRP beyond the 100 billion supply cap, which they reproduced and fixed in xrpld 3.4.1 with no evidence of exploitation in the wild.", "detailed_summary_zh": "XRP Ledger developers disclosed a critical payment-path vulnerability dating to 2015 that could have let attackers mint and spend XRP beyond the 100 billion supply cap, which they reproduced and fixed in xrpld 3.4.1 with no evidence of exploitation in the wild.", "detailed_summary_en": "XRP Ledger developers disclosed a critical payment-path vulnerability dating to 2015 that could have let attackers mint and spend XRP beyond the 100 billion supply cap, which they reproduced and fixed in xrpld 3.4.1 with no evidence of exploitation in the wild.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199797", "rss:www.coindesk.com_arc_outboundfeeds_rss_:22c5ef50138e0f13", "telegram:foresightnews:120110", "telegram:theblockbeats:199873", "rss:thedefiant.io_api_feed:d936df6aaabde2cb" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371119?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://www.coindesk.com/tech/2026/10/10/xrp-ledger-patched-decade-old-bug-that-could-create-billions-of-dollars-in-xrp-from-nothing", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/114920", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371198?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://thedefiant.io/news/security/xrp-ledger-discloses-decade-old-bug-that-could-mint-trillions", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e2677829f876abc8", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-11T10:30:30Z", "published_at": "2026-10-11T10:30:30Z", "first_seen_at": "2026-10-11T10:57:32.064494Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "AI 发现 XRP Ledger 漏洞，可能铸造 18 万亿枚代币并危及 940 亿美元市场", "title_en": "AI discovers XRP Ledger flaw that could mint 18 trillion tokens and put $94 billion market at risk", "what_changed_zh": "新披露显示该漏洞由 Veria Labs 的 AI 安全代理发现，可单笔交易凭空生成约 18 万亿 XRP，RippleX 绕过常规治理流程紧急修复，并支付 25 万美元赏金；未发生链上利用。", "what_changed_en": "New disclosure reveals the flaw was found by Veria Labs' AI security agent, could generate ~18 trillion XRP in a single transaction, and prompted RippleX to deploy an emergency fix bypassing standard governance, with a $250,000 bounty; no on-chain exploitation occurred.", "current_state_zh": "XRP Ledger 的十年旧支付引擎漏洞由 AI 代理发现，可能凭空生成约 18 万亿 XRP，RippleX 绕过常规修订流程紧急修复；未产生未授权 XRP，无资金损失。", "current_state_en": "XRP Ledger's decade-old payment-engine flaw was discovered by an AI agent, could have minted ~18 trillion XRP, and was emergency-patched by RippleX outside the usual amendment process; no unauthorized XRP was created and no funds were lost.", "detailed_summary_zh": "An AI security agent uncovered a decade-old XRP Ledger bug that could have created roughly 18 trillion XRP in a single transaction, prompting developers to bypass standard governance and deploy an emergency patch.", "detailed_summary_en": "An AI security agent uncovered a decade-old XRP Ledger bug that could have created roughly 18 trillion XRP in a single transaction, prompting developers to bypass standard governance and deploy an emergency patch.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.95, "story_ids": [ "rss:cryptoslate.com_feed_:bae377c2711984f1", "rss:www.theblock.co_rss.xml:97808fc00e2e7572" ], "sources": [ { "url": "https://cryptoslate.com/ai-discovers-xrp-ledger-flaw-that-could-mint-18-trillion-tokens-and-put-94-billion-market-at-risk/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://www.theblock.co/news/ecosystems/2026-10-11-xrp-ledger-patches-decade-old-bug-that-could-have-minted-trillions-of-xrp-418230", "label": "The Block", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e8a8f1043121e2ea", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-11T15:45:15Z", "published_at": "2026-10-11T15:45:15Z", "first_seen_at": "2026-10-11T17:44:38.214068Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "AI 发现 XRP Ledger 漏洞，可能凭空铸造 18 万亿枚代币，危及 940 亿美元市场", "title_en": "AI discovers XRP Ledger flaw that could mint 18 trillion tokens and put $94 billion market at risk", "what_changed_zh": "一次 AI 辅助安全审查发现 XRP Ledger 存在一个漏洞，在最坏情况下可能允许创建 18 万亿枚代币，并威胁约 940 亿美元的 XRP 市场。", "what_changed_en": "An AI-assisted security review uncovered a flaw in the XRP Ledger that, in a worst case, could allow the creation of 18 trillion tokens and threaten the roughly $94 billion XRP market.", "current_state_zh": "一次 AI 辅助安全审查发现 XRP Ledger 存在一个漏洞，在最坏情况下可能允许创建 18 万亿枚代币，并威胁约 940 亿美元的 XRP 市场。", "current_state_en": "An AI-assisted security review uncovered a flaw in the XRP Ledger that, in a worst case, could allow the creation of 18 trillion tokens and threaten the roughly $94 billion XRP market.", "detailed_summary_zh": "An AI-assisted security review uncovered a flaw in the XRP Ledger that, in a worst case, could allow the creation of 18 trillion tokens and threaten the roughly $94 billion XRP market.", "detailed_summary_en": "An AI-assisted security review uncovered a flaw in the XRP Ledger that, in a worst case, could allow the creation of 18 trillion tokens and threaten the roughly $94 billion XRP market.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:31c7632ab314da02" ], "sources": [ { "url": "https://cryptorank.io/news/feed/74f15-ai-discovers-xrp-ledger-flaw-that-could-mint-18-trillion-tokens-and-put-94-billion-market-at-risk", "label": "CryptoRank", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_40df1472a2cadd08", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-11T23:45:06Z", "published_at": "2026-10-11T23:45:06Z", "first_seen_at": "2026-10-12T06:40:35.423708Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "XRP Ledger 披露可能凭空创建无限量 XRP 的严重漏洞", "title_en": "XRP Ledger Reveals Critical Bug That Could Have Created Unlimited XRP", "what_changed_zh": "XRP Ledger 披露了一个严重漏洞，可能允许无限量创建 XRP，其严重程度足以威胁该网络供应量的完整性。", "what_changed_en": "The XRP Ledger disclosed a critical bug that could have allowed unlimited XRP to be created, a flaw serious enough to threaten the integrity of the network's supply.", "current_state_zh": "XRP Ledger 披露了一个严重漏洞，可能允许无限量创建 XRP，其严重程度足以威胁该网络供应量的完整性。", "current_state_en": "The XRP Ledger disclosed a critical bug that could have allowed unlimited XRP to be created, a flaw serious enough to threaten the integrity of the network's supply.", "detailed_summary_zh": "The XRP Ledger disclosed a critical bug that could have allowed unlimited XRP to be created, a flaw serious enough to threaten the integrity of the network's supply.", "detailed_summary_en": "The XRP Ledger disclosed a critical bug that could have allowed unlimited XRP to be created, a flaw serious enough to threaten the integrity of the network's supply.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:85d5636c4d489cda" ], "sources": [ { "url": "https://cryptorank.io/news/feed/80247-xrp-ledger-reveals-critical-bug-that-could-have-created-unlimited-xrp", "label": "CryptoRank", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_bf000cf475a3d5ca", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-12T00:35:02Z", "published_at": "2026-10-12T00:35:02Z", "first_seen_at": "2026-10-12T02:37:17.603887Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "XRP Ledger基金会澄清安全修复疑问：未增发XRP，供应量仍固定", "title_en": "XRP Ledger基金会澄清安全修复疑问：未增发XRP，供应量仍固定", "what_changed_zh": "XRP Ledger 基金会澄清 xrpld 3.4.1 修复的是需数百次刻意构造操作才能触发的规则绕过漏洞，而非 XRP 增发；XRP 总供应量固定为 1000 亿枚，当前流通约 999.86 亿枚。基金会还说明该漏洞由 Cayden Liao 与 Veria AI 负责任披露，并于 9 月 25 日发布公开二进制文件，后续通过超过 80% 支持持续两周的正常修正案投票使 3.4.1 成为必要版本。", "what_changed_en": "The XRP Ledger Foundation clarified that the xrpld 3.4.1 fix addressed a rule-bypass vulnerability requiring hundreds of deliberately crafted operations, not XRP inflation; total supply remains fixed at 100 billion, with about 99.986 billion currently circulating. It also said the flaw was responsibly disclosed by Cayden Liao and Veria AI, public binaries were released on September 25, and 3.4.1 later became a required version through a normal amendment vote with over 80% support sustained for two weeks.", "current_state_zh": "XRP Ledger 的旧支付引擎漏洞已在 xrpld 3.4.1 中修复，基金会确认修复不涉及增发，XRP 供应量仍固定为 1000 亿枚；漏洞由 Cayden Liao 与 Veria AI 发现并负责任披露，修复经紧急协调分发后已通过正常修正案投票正式生效，未发生未授权 XRP 铸造或资金损失。", "current_state_en": "The old XRP Ledger payment-engine vulnerability was fixed in xrpld 3.4.1; the Foundation confirmed the fix did not involve inflation and XRP supply remains fixed at 100 billion. The flaw was discovered and responsibly disclosed by Cayden Liao and Veria AI, the fix was distributed via emergency coordination and later ratified through the normal amendment vote, with no unauthorized XRP minting or fund loss.", "detailed_summary_zh": "The XRP Ledger Foundation clarified that the xrpld 3.4.1 security fix addressed a hard-to-trigger rule-bypass vulnerability rather than any XRP inflation, affirming the 100 billion fixed supply and outlining its coordinated disclosure and amendment ratification process.", "detailed_summary_en": "The XRP Ledger Foundation clarified that the xrpld 3.4.1 security fix addressed a hard-to-trigger rule-bypass vulnerability rather than any XRP inflation, affirming the 100 billion fixed supply and outlining its coordinated disclosure and amendment ratification process.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.93, "story_ids": [ "telegram:theblockbeats:199929" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371255?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_2caf2e492616c267", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-12T01:21:29Z", "published_at": "2026-10-12T01:21:29Z", "first_seen_at": "2026-10-12T02:37:38.234529Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "XRP Ledger 为无限 XRP 漏洞的紧急补丁进行辩护", "title_en": "XRP Ledger defends emergency patch for unlimited XRP bug", "what_changed_zh": "XRP Ledger 基金会与开发者公开为 9 月 25 日紧急补丁辩护，称若等待常规两周验证者投票会提前暴露漏洞；他们否认中心化指控，强调决定由基金会、RippleX、核心开发者和验证者共同做出，且 3.4.1 后来通过正常修正案投票以超过 80% 支持持续两周成为必需版本。", "what_changed_en": "The XRP Ledger Foundation and developers publicly defended the Sept. 25 emergency patch, saying waiting for the usual two-week validator vote would have exposed the flaw; they rejected centralization claims, stressing the decision was joint among the Foundation, RippleX, core developers and validators, and that 3.4.1 later became required via a normal amendment vote with over 80% support sustained for two weeks.", "current_state_zh": "XRP Ledger 的旧支付引擎漏洞已在 xrpld 3.4.1 中修复，3.4.1 已通过正常修正案投票成为必需版本；基金会与开发者正公开回应关于紧急补丁绕过常规治理和网络中心化程度的质疑，确认无未授权 XRP 铸造或资金损失。", "current_state_en": "The old XRP Ledger payment-engine vulnerability is fixed in xrpld 3.4.1, which became a required version through a normal amendment vote; the Foundation and developers are publicly responding to questions about the emergency patch bypassing normal governance and XRPL's decentralization, with no unauthorized XRP minting or fund loss confirmed.", "detailed_summary_zh": "XRP Ledger developers defended their Sept. 25 emergency patch for a bug that could have created XRP beyond the network's fixed supply, saying they bypassed the usual two-week validator vote because publishing the fix first would have exposed the flaw to attackers, a move that has raised questions about how decentralized XRPL really is.", "detailed_summary_en": "XRP Ledger developers defended their Sept. 25 emergency patch for a bug that could have created XRP beyond the network's fixed supply, saying they bypassed the usual two-week validator vote because publishing the fix first would have exposed the flaw to attackers, a move that has raised questions about how decentralized XRPL really is.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.92, "story_ids": [ "rss:cointelegraph.com_rss:32ec4b80a3d517e7" ], "sources": [ { "url": "https://cointelegraph.com/news/xrp-ledger-defends-emergency-patch-for-unlimited-xrp-bug?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_edecc1c4e0c84116", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-12T08:32:17Z", "published_at": "2026-10-12T08:32:17Z", "first_seen_at": "2026-10-12T10:40:56.257779Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "为何一个可能威胁XRP 1000亿供应上限的漏洞多年未被发现", "title_en": "Why a bug that could have threatened XRP's 100 billion supply cap stayed hidden for years", "what_changed_zh": "XRP Ledger 基金会进一步说明，该漏洞之所以多年未被发现，是因为正常账本参数从未触发它。", "what_changed_en": "The XRP Ledger Foundation further explained that the bug went undetected for years because normal ledger parameters never triggered it.", "current_state_zh": "XRP Ledger 基金会继续披露该供应上限相关漏洞的细节，说明其因正常账本参数从未触发而多年未被发现；XRP 供应上限未被破坏，也未发生利用。", "current_state_en": "The XRP Ledger Foundation continued disclosing details of the supply-cap-related bug, explaining it stayed hidden for years because normal ledger parameters never triggered it; the XRP supply cap was not broken and no exploitation occurred.", "detailed_summary_zh": "The XRP Ledger Foundation disclosed that a bug which could have broken XRP's 100 billion supply cap went undetected for years because normal ledger parameters never triggered it.", "detailed_summary_en": "The XRP Ledger Foundation disclosed that a bug which could have broken XRP's 100 billion supply cap went undetected for years because normal ledger parameters never triggered it.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.9, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:ce29222e3baec98e" ], "sources": [ { "url": "https://www.coindesk.com/tech/2026/10/12/why-a-bug-that-could-have-threatened-xrp-s-100-billion-supply-cap-stayed-hidden-for-years", "label": "CoinDesk", "source_type": "rss", "official": false } ] }, { "update_id": "upd_b0d7b562a23d2670", "event_id": "evt_5e0ff89b9b3aed1e", "occurred_at": "2026-10-12T15:56:35Z", "published_at": "2026-10-12T15:56:35Z", "first_seen_at": "2026-10-12T16:21:16.629913Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "XRP账本支付引擎藏有自2015年以来的伪造漏洞", "title_en": "XRP Ledger’s Payment Engine Had a Counterfeiting Bug Hiding Since 2015", "what_changed_zh": "新披露该漏洞是支付引擎中的整数溢出，自 2015 年支付引擎编写以来一直存在；攻击者通过消耗数百个特制订单簿报价可使买方应付款项溢出并少付，而账本内置的“未创建 XRP”安全检查使用同样的错误算术，因此无法拦截。漏洞由 XRPL 漏洞赏金计划于 9 月报告。", "what_changed_en": "Newly disclosed that the flaw was an integer overflow in the payment engine, present since the engine was written in 2015; an attacker could consume hundreds of specially crafted order-book offers to overflow the buyer's owed amount and underpay, while the ledger's built-in 'no XRP created' safety check used the same broken arithmetic and failed to catch it. The bug was reported through the XRPL bug bounty program in September.", "current_state_zh": "XRP Ledger 已披露并修复支付引擎中的整数溢出漏洞，该漏洞自 2015 年起潜伏且普通支付不会触发；3.4.1 补丁于 9 月 25 日发布，超过 80% 可信验证者当日已运行该补丁；无证据表明漏洞曾被利用。", "current_state_en": "The XRP Ledger disclosed and patched an integer overflow in the payment engine that had been dormant since 2015 and is not triggered by normal payments; the 3.4.1 fix shipped on Sept. 25, and more than 80% of trusted validators were running it that day; there is no evidence the bug was ever exploited.", "detailed_summary_zh": "XRP Ledger maintainers disclosed and patched a decade-old integer overflow in the payment engine that could have let an attacker mint counterfeit XRP, with no evidence the bug was ever exploited.", "detailed_summary_en": "XRP Ledger maintainers disclosed and patched a decade-old integer overflow in the payment engine that could have let an attacker mint counterfeit XRP, with no evidence the bug was ever exploited.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.95, "story_ids": [ "rss:decrypt.co_feed:2002debfe73d4a80" ], "sources": [ { "url": "https://decrypt.co/380693/xrp-ledger-payment-engine-counterfeiting-bug-hiding", "label": "Decrypt", "source_type": "rss", "official": false } ] } ] }