XRP Ledger bug from 2015 that let XRP be created out of nothing is fixed: what holders should do

What happened

On Friday, October 9, RippleX, the development arm of Ripple, published a report on a vulnerability in the XRP Ledger. By the developers' estimate, the bug had been sitting in the network's payment engine since 2015, when that code was written. It made it possible to send a payment after which new XRP appeared on the network, even though the sender paid almost nothing.

The timeline is short:

• On September 22, researcher Cayden Liao and Veria AI reported the bug through the bug bounty program.
• On September 25, version 3.4.1 of the xrpld server software came out with the fix. The developers didn't say at the time what exactly had been repaired and asked node operators to update right away.
• On October 9, RippleX disclosed the details.

RippleX engineers reproduced the attack on a separate test server and confirmed that XRP created this way could be spent in the very next transaction. The company found no trace of anyone exploiting the bug on public networks. xrpld 3.4.0 and all earlier versions were vulnerable.

For XRP this is an especially sensitive subject. All 100 billion coins were created when the network launched in 2012, there is no mining, and the software is built so that new XRP cannot appear.

How the bug worked

The XRP Ledger has its own built-in exchange: any account can place an offer to trade one token for another, and a payment can pass through several such offers at once. The bug was hiding in how the total was calculated. As CoinDesk describes it, the attack would have gone like this:

1. The attacker opens several hundred accounts.
2. Each account places an offer: I give a tiny amount of my token and want a huge amount of XRP for it.
3. A single payment buys up all of those offers at once.
4. The total XRP the buyer owes comes out too large. The number doesn't fit in the space reserved for it and "rolls over", like an odometer that shows zeros after all the nines.
5. The sellers receive their XRP in full, while almost nothing is deducted from the buyer.

Programmers call this an integer overflow. The network has a safeguard for cases like this: after every transaction it checks that no new XRP has appeared. But that check used the same miscalculated total and would have noticed nothing. A separate cap on how much XRP a single account can receive would not have helped either: the coins were spread across hundreds of accounts in small portions.

The attack would have been cheap. It takes a few hundred XRP to open the accounts, most of which can be recovered, plus transaction fees. XRP itself trades at about $1.40 on October 10, and the price barely reacted to the news.

Why the bug went unnoticed for more than ten years

It needed an unusual set of conditions: hundreds of offers with enormous amounts, bought up by a single payment. Ordinary payments never reach numbers like that, so the network ran for years without a glitch.

It was found with the help of AI, and this is not the first case of its kind. In February 2026, researcher Pranamya Keshkamat and Cantina's Apex, an AI tool, discovered a bug in signature verification in the upcoming Batch amendment. Back then, on February 23, emergency release 3.1.1 came out, and the amendment was kept off the main network. CoinDesk notes that since July AI has helped uncover several long-standing bugs in crypto software, including in the Coldcard wallet and in Core Lightning nodes.

The takeaway is uncomfortable but fair: old code is not the same as audited code. The same tools are available to researchers and attackers alike, and what matters is who gets to the bug first.

Could your XRP have been stolen

No. The bug gave no access to other people's accounts or keys. It could create new coins but could not take existing ones. The risk lay elsewhere: if someone had printed billions of XRP and managed to sell them, the price and trust in the whole network would have suffered, meaning every holder at once.

Something similar once happened to bitcoin. In August 2010, the same kind of overflow produced about 184 billion BTC in a single transaction, against a cap of 21 million. Developers released a fix within hours, and the network discarded the bad block. The XRP Ledger never got that far: the bug was closed before outsiders learned about it.

What XRP holders should do

If your XRP sits in your own wallet, you don't need to do anything. The fix applies to the network's servers and leaves wallets and keys untouched.

• Your own wallet. There is no need to change your seed phrase or address, or to move your coins.
• An exchange or custodial service. Updating the nodes is their job. If a platform pauses XRP deposits or withdrawals for a while to update, that is a routine procedure.
• Your own node or validator. Update to xrpld 3.4.1 or later. According to crypto media reports, once the next amendment is activated, servers on older versions stop syncing with the network.
• "Urgently update your XRP wallet" emails. After big headlines scammers send out links like these in bulk. The real fix requires nothing from you, and a seed phrase must never be typed into any website.

The story is also a reminder of something simple. A balance on an exchange is an entry in its database, while coins in your own wallet are an entry on the network itself. You can take your XRP into your own hands with an ordinary withdrawal from the exchange, and if you are starting from zero, a crypto exchange that sends coins straight to your address will help. We've covered how a custodial wallet differs from a non-custodial one separately.

How to swap XRP without registration

With VertEXchange you don't need an account, email or phone number to make a swap. You pick a pair, for example to buy XRP with bitcoin, paste your wallet address, and see the rate and the amount you'll receive before you send anything. The coins go straight to your address: VertEXchange doesn't hold them.

• A fixed rate holds for about 15 minutes, so the amount won't change while your transfer is being confirmed.
• You can add a refund address: your coins go back there if the exchange doesn't go through.
• Personal fields of an operation are deleted 24 hours after it completes, and your exchange history stays only in your browser.
• Support chat is available on every page, and issues are resolved using your exchange code.

The way back works the same: you can swap XRP to bitcoin without registration. If you receive XRP to an exchange account, don't forget the Destination Tag: we explained why an XRP transfer without a tag doesn't arrive in a separate guide.

FAQ

What bug was found in the XRP Ledger in October 2026?

An integer overflow in the payment engine. A single payment through hundreds of specially placed offers on the built-in exchange could create new XRP while the buyer paid almost nothing. The fix came out on September 25 in xrpld 3.4.1, and the details were disclosed on October 9.

Did anyone manage to create extra XRP?

According to RippleX, no trace of the bug being exploited on public networks has been found. The attack was reproduced only on a separate test server.

Is my XRP safe?

The bug gave no access to other people's accounts or keys, so it couldn't be used to steal coins. The threat was to the total supply rather than to individual wallets.

Do I need to update my wallet or move my XRP?

No. The network's servers are what gets updated: nodes and validators. A wallet owner doesn't need to do anything, and emails asking you to "update your wallet" through a link should never be answered.

How much XRP exists in total?

100 billion, all created when the network launched in 2012. The protocol has no way to issue new XRP, which is why a bug that creates coins is rated critical.

Who found the vulnerability?

Researcher Cayden Liao and Veria AI. They reported it to the developers on September 22 through the bug bounty program.