An XRP Ledger security bug could have created 18.45 trillion XRP

What it is

An integer overflow in the XRP Ledger payment engine, in code added in 2015. It is fixed in xrpld 3.4.1, released 2026-09-25. Veria AI (Veria Labs) detected it on 2026-09-21, and the report went through the XRPL bug bounty the next day. CoinDesk also credits researcher Cayden Liao. RippleX found no evidence of exploitation on public networks.

How it works

• The bug sits in the payment engine's handling of multiple DEX offers consumed by one payment. When the combined XRP amount exceeds what the 64-bit calculation can hold, the software computes a much smaller total instead of rejecting the transaction.
• The attacker opens hundreds of accounts. Each offers a tiny quantity of another token for an unusually large XRP payment, and one payment then buys all of those offers.
• The selling accounts receive their full XRP amounts, while the buyer pays almost nothing, because the overflowed total understates the payment.
• The check meant to catch newly created XRP uses the same wrong total, so it does not fire.
• A separate account-receipt limit does not help either, because the XRP is spread across hundreds of accounts.

Preconditions / Affected

• The attacker needs a few hundred XRP, most of it recoverable, plus transaction fees (per CoinDesk).
• Veria Labs puts the potential yield at about 18.45 trillion XRP in one transaction, over 184 times the 100 billion fixed supply. The minted XRP could be spent or sent to exchanges.
• The researchers believed the flaw threatened XRP's entire market cap, which they put at about $94 billion when they filed the report.
• The page does not list the versions affected before 3.4.1.

What to do

• Run the xrpld 3.4.1 binaries if you operate a node.
• Be aware that the patch source was withheld, so you cannot review the diff yourself or build the fix from source. The page does not say whether the source will be published later.

Caveats

• RippleX reproduced the attack only on a standalone server, where the created XRP funded a follow-on transaction. That is separate from the public network.
• The release notes initially did not say what the release fixed (per CoinDesk).
• Withholding source drew criticism that it conflicts with XRPL's open-source commitments.
• RippleX engineer Mayukha Vadari said on X that AI now makes quiet fixes in a normal public release easy to catch and reverse engineer. That is the stated reason for the binaries-only approach.
• The page is an AI-assisted article that relies on secondary reports (CoinDesk, U.Today), so treat the dollar figures and the cost estimate as reported, not verified.