TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A flaw believed to date to 2015 could have let an attacker use the XRP Ledger’s built-in exchange to receive newly created XRP while paying almost nothing. RippleX said it found no evidence of exploitation on public networks and shipped a fix in xrpld 3.4.1 on Sept. 25, 2026.
RippleX patched a vulnerability in the XRP Ledger that researchers said could have allowed attackers to create and spend new XRP by exploiting a counting error in the ledger’s built-in exchange. The flaw is believed to date to 2015; RippleX said it found no evidence of exploitation on public networks.
Researcher Cayden Liao and Veria AI found the issue and reported it internally on Sept. 22, according to CoinDesk’s report. RippleX engineers reproduced the attack on a standalone server and confirmed that XRP created through the method could be spent in a later transaction. The reproduction establishes that the exploit could work in a test environment; it does not show that anyone used it on a live public ledger.
The reported attack used the ledger’s built-in exchange, where accounts can offer to swap one token for another. An attacker could open hundreds of accounts and have each offer a small amount of a token for an unusually large amount of XRP. A single payment could then take up all of those offers. If the total XRP owed exceeded what the software could count correctly, the selling accounts could receive the offered XRP while the buyer was charged almost nothing.
The ledger’s checks were also vulnerable to the same miscount, according to the report. A post-transaction check intended to catch newly created XRP could rely on the incorrect total and fail to detect it. The attack could also spread receipts across hundreds of accounts, avoiding a separate limit on how much XRP any one account may receive. Researchers said the method required a few hundred XRP to open accounts, most of which could be recovered, plus transaction fees.
Protecting XRP’s Fixed Supply
The flaw mattered because it could have undermined a defining rule of the network: XRP has a fixed supply of 100 billion tokens, all created when the ledger launched in 2012. If an attacker could create additional XRP and later spend or sell it, the vulnerability could have affected confidence in the supply limit and the integrity of transactions that depend on it.
The report describes a potential path from an accounting error to new spendable tokens, not evidence that extra XRP entered circulation. RippleX’s statement that it found no public-network exploitation is a key distinction. The software fix reduces the risk from this specific reported flaw, but the available information does not establish whether any other systems or parties were affected. For users and institutions relying on the ledger, the incident highlights why checks that enforce supply rules must remain accurate even when transactions involve many accounts and offers.
As an affiliate, we earn on qualifying purchases.
The vulnerability was believed to have been present since 2015, several years after the XRP Ledger launched in 2012. The ledger’s software was designed so no XRP could be added beyond its initial 100 billion-token supply. The bug did not change that stated design; it exposed a route by which a counting error might have bypassed the protections enforcing it.
RippleX, the development arm of Ripple, released xrpld 3.4.1 on Sept. 25. The release shipped without publicly identifying the flaw it fixed, according to CoinDesk. The details became public through the report published Oct. 10. CoinDesk also placed the discovery among a series of long-hidden crypto security vulnerabilities reported since July, some identified with help from AI. Those incidents provide timing context but do not establish that the XRP Ledger flaw was connected to them.
“It found no evidence the flaw was exploited on any public network.”
— RippleX, as reported by CoinDesk
As an affiliate, we earn on qualifying purchases.
No Public Exploit Evidence Reported
RippleX said it found no evidence of exploitation on public networks, but the supplied report does not detail what records were examined, how far back the review went or whether an independent party audited the search. The researchers’ successful reproduction took place on a standalone server, not a live public network.
The report also does not provide a complete technical account of the patch, identify every affected software version or explain how operators can independently verify that their systems are protected. The flaw is described as dating to 2015, but the precise versions and conditions under which the exploit could have worked are not specified in the supplied material. No evidence is provided that any XRP was created or sold through this method.
As an affiliate, we earn on qualifying purchases.
Operators Need the Patched Release
The immediate next step for XRP Ledger operators is to review their software version and the xrpld 3.4.1 fix, released Sept. 25. The source material does not set out an operator upgrade deadline or say whether further releases are planned. RippleX or the researchers may publish additional technical details clarifying which versions were affected and how the corrected accounting checks work.
Any later assessment should keep two points separate: the attack was reproduced in a controlled setting, while RippleX reported no evidence that it happened on public networks. Further information about the company’s review, the patch and independent verification would help clarify the scope and resolution of the incident.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the XRP Ledger vulnerability allow?
Researchers said a counting error in the ledger’s built-in exchange could let an attacker use offers spread across hundreds of accounts to receive new XRP while paying almost nothing. RippleX engineers reproduced the method on a standalone server.
Was the flaw exploited on a public network?
RippleX said it found no evidence that the vulnerability was exploited on any public network. The report describes a successful reproduction in a controlled environment, not a confirmed live attack.
How was the flaw fixed?
RippleX shipped a fix in xrpld 3.4.1 on Sept. 25, 2026. The supplied report does not give a full technical description of the patch or a list of all affected software versions.
Why was the bug considered serious?
The XRP Ledger’s stated supply is capped at 100 billion XRP, all created at launch in 2012. A way to create additional spendable tokens could have compromised confidence in that supply rule, although the report does not establish that any extra XRP entered circulation.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
