100 Billion XRP Supply Was Nearly Broken by a 10-Year Bug

XRP Ledger Bug Exposed 10-Year Vulnerability

Introduction

A flaw in the XRP Ledger's payment software could have let an attacker create spendable XRP out of thin air, according to a security report published Friday. The bug had likely gone unnoticed since 2015.

The Bug

XRP's supply is capped at 100 billion tokens, and the token is worth about $88.8 billion at $1.41. RippleX, Ripple's developer arm, said it found no sign anyone used the flaw. The bug was discovered by researcher Cayden Liao and Veria AI, and a fix was released on September 25, 2026.

How the Bug Worked

The XRP Ledger has a built-in marketplace where accounts list offers to trade one token for another. According to the report, an attacker could open a few hundred accounts. Each would offer a tiny amount of a token in exchange for a huge amount of XRP. A single payment would then buy every offer at once. The software's running total grew too large for its counter and reset to a tiny number, much like an odometer rolling past its limit. The selling accounts were paid in full while the buyer paid almost nothing.

Ripple's Response

RippleX stated that a public vote would have exposed the bug, and the fix was implemented without a public vote. The disclosure lands a day after Cyber Capital founder Justin Bons called selling XRP as decentralized 'fraud,' in an XRP decentralization debate with Ripple's David Schwartz. The report says the XRPL Foundation, RippleX, and validators made the call together. RippleX said votes remain the rule for future changes.