Current outcome
The XRP Ledger disclosed and patched an integer overflow in the payment engine that had been dormant since 2015 and is not triggered by normal payments; the 3.4.1 fix shipped on Sept. 25, and more than 80% of trusted validators were running it that day; there is no evidence the bug was ever exploited.
Progress timeline
8 material updates- #01
XRP Ledger修复存在近11年重大漏洞，攻击者曾可利用其凭空生成XRP
XRP Ledger developers disclosed a critical payment-path vulnerability dating to 2015 that could have let attackers mint and spend XRP beyond the 100 billion supply cap, which they reproduced and fixed in xrpld 3.4.1 with no evidence of exploitation in the wild.
Source evidence: theblockbeats · CoinDesk · foresightnews · theblockbeats · The Defiant
- #02
AI discovers XRP Ledger flaw that could mint 18 trillion tokens and put $94 billion market at risk
New disclosure reveals the flaw was found by Veria Labs' AI security agent, could generate ~18 trillion XRP in a single transaction, and prompted RippleX to deploy an emergency fix bypassing standard governance, with a $250,000 bounty; no on-chain exploitation occurred.
State after update: XRP Ledger's decade-old payment-engine flaw was discovered by an AI agent, could have minted ~18 trillion XRP, and was emergency-patched by RippleX outside the usual amendment process; no unauthorized XRP was created and no funds were lost.
Source evidence: CryptoSlate · The Block
- #03
AI discovers XRP Ledger flaw that could mint 18 trillion tokens and put $94 billion market at risk
An AI-assisted security review uncovered a flaw in the XRP Ledger that, in a worst case, could allow the creation of 18 trillion tokens and threaten the roughly $94 billion XRP market.
Source evidence: CryptoRank
- #04
XRP Ledger Reveals Critical Bug That Could Have Created Unlimited XRP
The XRP Ledger disclosed a critical bug that could have allowed unlimited XRP to be created, a flaw serious enough to threaten the integrity of the network's supply.
Source evidence: CryptoRank
- #05
XRP Ledger基金会澄清安全修复疑问：未增发XRP，供应量仍固定
The XRP Ledger Foundation clarified that the xrpld 3.4.1 fix addressed a rule-bypass vulnerability requiring hundreds of deliberately crafted operations, not XRP inflation; total supply remains fixed at 100 billion, with about 99.986 billion currently circulating. It also said the flaw was responsibly disclosed by Cayden Liao and Veria AI, public binaries were released on September 25, and 3.4.1 later became a required version through a normal amendment vote with over 80% support sustained for two weeks.
State after update: The old XRP Ledger payment-engine vulnerability was fixed in xrpld 3.4.1; the Foundation confirmed the fix did not involve inflation and XRP supply remains fixed at 100 billion. The flaw was discovered and responsibly disclosed by Cayden Liao and Veria AI, the fix was distributed via emergency coordination and later ratified through the normal amendment vote, with no unauthorized XRP minting or fund loss.
Source evidence: theblockbeats
- #06
XRP Ledger defends emergency patch for unlimited XRP bug
The XRP Ledger Foundation and developers publicly defended the Sept. 25 emergency patch, saying waiting for the usual two-week validator vote would have exposed the flaw; they rejected centralization claims, stressing the decision was joint among the Foundation, RippleX, core developers and validators, and that 3.4.1 later became required via a normal amendment vote with over 80% support sustained for two weeks.
State after update: The old XRP Ledger payment-engine vulnerability is fixed in xrpld 3.4.1, which became a required version through a normal amendment vote; the Foundation and developers are publicly responding to questions about the emergency patch bypassing normal governance and XRPL's decentralization, with no unauthorized XRP minting or fund loss confirmed.
Source evidence: Cointelegraph
- #07
Why a bug that could have threatened XRP's 100 billion supply cap stayed hidden for years
The XRP Ledger Foundation further explained that the bug went undetected for years because normal ledger parameters never triggered it.
State after update: The XRP Ledger Foundation continued disclosing details of the supply-cap-related bug, explaining it stayed hidden for years because normal ledger parameters never triggered it; the XRP supply cap was not broken and no exploitation occurred.
Source evidence: CoinDesk
- #08
XRP Ledger’s Payment Engine Had a Counterfeiting Bug Hiding Since 2015
Newly disclosed that the flaw was an integer overflow in the payment engine, present since the engine was written in 2015; an attacker could consume hundreds of specially crafted order-book offers to overflow the buyer's owed amount and underpay, while the ledger's built-in 'no XRP created' safety check used the same broken arithmetic and failed to catch it. The bug was reported through the XRPL bug bounty program in September.
State after update: The XRP Ledger disclosed and patched an integer overflow in the payment engine that had been dormant since 2015 and is not triggered by normal payments; the 3.4.1 fix shipped on Sept. 25, and more than 80% of trusted validators were running it that day; there is no evidence the bug was ever exploited.
Source evidence: Decrypt