The XRP Ledger Foundation has explained that a critical vulnerability capable of undermining XRP’s fixed supply remained hidden for years because ordinary transactions never activated the conditions needed to expose it.
The flaw could theoretically have allowed an attacker to generate new XRP without providing the corresponding funds. According to the foundation, the vulnerability remained in the XRP Ledger’s software for more than a decade because typical network activity did not come close to triggering it.
Researcher Cayden Liao and Veria AI discovered the issue on September 22 and reported it internally. The vulnerability was particularly serious because it threatened a core guarantee of the XRP Ledger: the total supply must not exceed the 100 billion XRP created when the blockchain launched in 2012.
RippleX released a software fix, and no damage from exploitation was reported. The foundation confirmed that the flaw did not result in the creation of additional XRP and said approximately 99.986 billion tokens remain in circulation.
The XRP Ledger (XRPL) is an open-source, decentralized layer-1 blockchain. XRP, its native cryptocurrency, has a fixed supply and is not designed to support the creation of new tokens. The asset is primarily used to cover transaction fees and facilitate currency exchanges through the ledger’s built-in decentralized exchange (DEX).
The vulnerability, which is believed to have existed since 2015, nevertheless presented a theoretical way to circumvent the network’s supply protections.
How the XRP Supply Vulnerability Could Have Been Exploited
The bug involved an “integer overflow,” a software error that occurs when a number exceeds the maximum value a system can represent. Depending on how the calculation is handled, the value can wrap around to a much smaller number, much like an old arcade machine’s score counter resetting after reaching its limit.
In the XRPL case, a transaction exceeding the system’s numerical limit could have produced an incorrectly calculated value. This might have bypassed normal balance checks, allowing sellers to receive the full XRP amounts associated with their offers while buyers were charged almost nothing. The resulting difference could effectively have created unauthorized XRP.
To exploit the flaw, an attacker could theoretically have established dummy accounts and posted fabricated token offers involving enormous quantities of XRP. The attacker could then act as the buyer and attempt to purchase the listed tokens in a single transaction.
If the exploit succeeded, the seller accounts could have received billions of XRP even though the buyer paid only a negligible amount. The discrepancy between the funds credited and the amount charged could have allowed the attacker to generate new tokens outside the ledger’s intended supply rules.
The attacker might then have attempted to transfer the newly created XRP to external cryptocurrency exchanges and sell it. However, this was a hypothetical attack scenario, not a confirmed incident. No evidence indicated that the vulnerability had been exploited on a public network.
Why Existing Security Checks Failed to Detect It
According to the XRP Ledger Foundation, the flaw remained undiscovered because exploiting it required hundreds of deliberately constructed operations at a scale far beyond normal transaction activity. The foundation said ordinary payments never approached the threshold needed to activate the vulnerability.
The network’s internal safeguards also had a weakness. A check that runs after transactions to verify that no additional XRP has been created relied on the same incorrectly calculated total. As a result, the check could fail to detect the discrepancy because it was using the faulty calculation itself.
A separate safeguard restricted the amount of XRP that a single account could receive. However, that protection might not have stopped the hypothetical attack because an attacker could distribute the resulting tokens among hundreds of accounts, keeping each individual balance below the applicable limit.
The incident illustrates how security controls can fail when they depend on the same flawed calculation or when an attack is structured to avoid individual account thresholds.
AI Security Tools Become Part of XRPL’s Response
The foundation also pointed to artificial intelligence as an increasingly important factor in cybersecurity. AI-assisted tools can help legitimate researchers uncover hidden vulnerabilities, but they may also enable malicious actors to identify and analyze weaknesses more quickly.
To improve the ledger’s defenses, the foundation plans to expand AI-driven adversarial testing, introduce formal verification techniques, and strengthen its bug bounty program. These initiatives are intended to uncover additional weaknesses and improve confidence in XRPL’s security mechanisms.
Although the vulnerability posed a theoretical threat to XRP’s fixed supply, developers addressed the issue without evidence of unauthorized token creation. The foundation said it would provide further information as its security improvements progress.
