Go to app

Nature of the Bug

Published 10/12/2026, 12:40:21 AM

The bug was a decade-old integer overflow vulnerability in the XRP Ledger's (XRPL) payment engine that could theoretically have allowed an attacker to mint up to 18.45 trillion XRP in a single transaction—completely bypassing the network's hard-capped 100 billion supply. Discovered by AI security firm Veria Labs in September 2026 through a bug-bounty program Gaming Report, it was fixed in an emergency patch without a validator voteley, and developers found no evidence the bug was ever exploited on a public network.

Nature of the Bug

The flaw lived in the XRPL payment engine and involved an integer overflow. When a single payment filled many order-book offers, the XRP total could "wrap around" to a much smaller number, meaning sellers could receive large XRP credits while the buyer paid very little—effectively creating spendable XRP from nothing. [Source: https://www.binance.com/en/square/post/375709855646390] The overflow bypassed XRPL's supply safeguards, allowing minting beyond the fixed 100 billion XRP cap. [Source: https://cryptobriefing.com/xrp-ledger-overflow-bug-extra-xrp]

Scale of the Potential Impact

Timeline and Discovery

Exploitation Status

Developers found no evidence the bug was exploited on a public network. [Source: https://thedefiant.io/news/security/xrp-ledger-discloses-decade-old-bug-that-could-mint-trillions] [Source: https://phemex.com/news/article/xrp-ledger-patches-critical-minting-bug-that-could-have-created-1845-trillion-tokens-99473] RippleX Engineering Lead J. Ayo Akinyele confirmed the payment engine contained the severe, decade-long vulnerability and that it was discovered through the bug bounty program. [Source: https://www.kucoin.com/news/flash/ripplex-engineer-critical-10-year-xrp-ledger-vulnerability-discovered-and-fixed] [Verified by independent sources: https://www.rootdata.com/news/785115]

Conclusion

In short, the bug was an integer overflow in the XRP Ledger's payment engine, discovered by Veria Labs, that could have minted up to 18.45 trillion XRP but was patched in September 2026 without being exploited. The exact code-level exploit mechanics (how the wrap-around was precisely triggered) remain described in secondary summaries rather than a primary technical write-up, so that precise detail is not fully confirmed.