18 trillion XRP out of thin air — that’s 184 times the entire supply of the cryptocurrency that has ever existed. That was the theoretical number on the table when a security firm reported a flaw in the XRP Ledger’s code in September 2026, a flaw that had gone undetected for roughly a decade. The XRP Ledger security bug struck at the heart of the network: the internal payment and order-book engine that moves billions of dollars in value every day. The flaw wasn’t found by a traditional audit team, but by an AI agent built by security firm Veria Labs, founded by Cayden Liao.
The case is a vivid example of how the methods for uncovering critical blockchain vulnerabilities are changing, and how even code that has been reviewed for over a decade can still harbor a fundamental flaw.
Table of Contents
Key Takeaways
- The XRP Ledger security bug had been sitting in the rippled codebase, the XRP Ledger’s core software, since 2015, undetected for roughly ten years.
- An integer overflow in the internal order-book system could theoretically have allowed the creation of up to 18 trillion XRP, far beyond the fixed total supply of 100 billion XRP.
- Veria Labs’ AI agent (founder Cayden Liao) discovered the flaw; it was reported to RippleX on September 22, 2026.
- RippleX successfully reproduced the attack on a test server and shipped the fix in xrpld 3.4.1 on September 25, 2026 — bypassing the usual two-week voting process.
- Veria Labs received a record bug bounty of $250,000; there is no evidence the bug was ever exploited on the live network.
What Exactly Was the XRP Ledger Security Bug
The XRP Ledger security bug affected the so-called payment engine of the XRPL, the part of the system that processes payments between accounts and also uses the ledger’s built-in decentralized exchange (DEX). Through this order book, users can trade various tokens and XRP directly on the blockchain without needing an external exchange.
Technically, the flaw was an integer overflow — a counting error that occurs when a calculation produces a value larger than the underlying data structure can store. Such errors aren’t rare in software development, but in security-critical financial systems they can be potentially catastrophic, because they can fundamentally corrupt numbers.
“A single counting error at the core of the payment system was enough to theoretically create new XRP out of thin air, without any central authority ever authorizing it.”
The Mechanism Behind the Exploit
To understand the scope of the XRP Ledger security bug, it helps to look at the concrete attack path security researchers reconstructed.
Step by Step
- Setup: An attacker opens hundreds of accounts on the XRP Ledger.
- Manipulated offers: Each account offers a tiny amount of an arbitrary token in exchange for an unusually large amount of XRP.
- The triggering transaction: A single buyer account sends one payment transaction that buys up all of these offers simultaneously.
- The bug kicks in: Because of the integer overflow in the order book’s counting mechanism, the seller accounts get paid in full while the buyer account is only charged a fraction of what it actually owes.
- The delta: The difference between what was paid out and what was actually deducted equals newly created XRP — money that simply didn’t exist before.
This construction of many small, parallel trades executed within a single transaction is the key trick: it overloads the internal counter until it “wraps around” and returns incorrect values.
Why the Scale Was So Extreme
The theoretically possible amount of up to 18 trillion newly created XRP is wildly out of proportion to the network’s real economy. For context:
| Metric | Value |
|---|---|
| Fixed total XRP supply (founding supply) | 100 billion XRP |
| Theoretically mintable amount via the bug | up to 18 trillion XRP |
| Ratio to total supply | roughly 184x |
| XRP market cap at time of reporting | roughly $94 billion |
| Age of the vulnerability | roughly 10 years (since 2015) |
A successful exploit would have undermined the XRP Ledger’s fundamental promise of a fixed, unchangeable total token supply. Since XRP’s economic value rests heavily on that scarcity, the entire roughly $94 billion market cap would have been immediately at risk.
The Role of the AI Agent in the Discovery
What’s particularly notable about this case is how the flaw was found. Veria Labs, a blockchain security firm founded by Cayden Liao, deployed an AI agent that systematically analyzed the source code of rippled, the reference implementation of the XRP Ledger server software.
Unlike classic manual audits, where human reviewers search for known vulnerability patterns, an AI-driven approach can systematically scan large volumes of code for logical inconsistencies and edge cases that repeated manual reviews have missed over the years. That’s exactly what happened here: a core component of the system that had been in use since 2015 and had passed numerous prior audits still contained this serious counting error.
This case fits into a series of similar discoveries since July 2026, in which AI-assisted analysis uncovered long-hidden security flaws in cryptocurrency systems. These include a Coldcard hardware wallet bug linked to the theft of at least 1,367 BTC, as well as vulnerabilities in Core Lightning that forced Bitcoin node operators to disconnect as a precaution. The XRP Ledger security bug fits into a larger pattern: critical infrastructure long considered secure is increasingly being re-evaluated through machine-assisted analysis.
Disclosure and Fix Timeline
RippleX’s response to the report, the development team behind the XRP Ledger, moved unusually fast for infrastructure of this scale.
September 22, 2026: Veria Labs confidentially reports the flaw to RippleX.
Shortly after: RippleX successfully reproduces the described attack on its own test server, confirming that XRP created via the bug could indeed be spent in a follow-up transaction — decisive proof that this wasn’t just a theoretical flaw but a genuinely exploitable one.
September 25, 2026: The fix ships in software release xrpld 3.4.1. Notably, for the first time in over ten years, RippleX deliberately deviated from the usual two-week amendment-voting process in which validators across the network vote on changes. Given the severity of the XRP Ledger security bug, the fix was pushed through on an accelerated timeline instead.
October 9, 2026: RippleX publishes the official technical disclosure report on xrpl.org, documenting the bug’s details, the discovery process, and the fix.
Why Deviating From the Standard Process Matters
The XRP Ledger’s amendment-voting system is deliberately conservative: protocol changes normally require approval from a large majority of validators over a period of roughly two weeks. This mechanism is meant to prevent individual actors from unilaterally pushing changes onto the network.
The fact that RippleX bypassed this process in this specific case underscores how serious the situation was. A two-week window in which the vulnerability was publicly known but not yet fixed would have posed a significant risk. The accelerated response shows that security incidents of this magnitude can take precedence over formal governance processes when necessary.
The Bug Bounty Payout as a Signal
For reporting the XRP Ledger security bug, Veria Labs received a $250,000 payout, the largest amount ever paid out under the XRPL bug bounty program. That figure sends a clear signal: the developer community around the XRP Ledger considers finding fundamental flaws like this to be extremely valuable, especially when they threaten the core promise of a fixed total supply.
Bug bounty programs operate on a simple principle: security researchers who responsibly and confidentially report vulnerabilities instead of exploiting or publicizing them get paid for it. This model is well established across the software industry and plays a particularly important role in crypto, where bugs can cause immediate financial damage in the millions or billions.
No Evidence of Actual Exploitation
Both RippleX and Veria Labs emphasized, after concluding their investigations, that no evidence was found that the vulnerability was ever exploited on the live, public XRPL network. This is an important distinction from other incidents in the crypto industry, where vulnerabilities were only discovered after an actual theft had occurred.
In the case of the XRP Ledger security bug, this was a textbook case of responsible disclosure: the flaw was found, reported, verified, and fixed before any third party could discover and exploit it.
What This Case Means for Blockchain Security
The incident offers several lessons for developers and operators of blockchain infrastructure:
- Age doesn’t protect against bugs: Even code that has been in production for ten years and passed numerous audits can still contain fundamental vulnerabilities.
- AI-assisted analysis complements human audits: Systematic, machine-driven code analysis can spot patterns that repeated manual reviews miss.
- Fast response capability matters: RippleX’s willingness to deviate from the standard process shows that governance structures need to be flexible enough to react to critical security incidents.
- Bug bounty programs pay off: A $250,000 payout may sound large, but it’s negligible compared to the potential damage to a roughly $94 billion market cap.
Conclusion
The XRP Ledger security bug is a striking illustration of how deeply hidden flaws can remain buried in critical blockchain infrastructure, even after a decade of production use and repeated security reviews. The integer overflow in the XRP Ledger’s order-book system could theoretically have enabled the creation of 18 trillion XRP, undermining the very foundation of the cryptocurrency’s fixed total supply. The fact that the flaw was discovered through Veria Labs’ AI-driven analysis process, verified and fixed by RippleX within days, and never caused any real damage, is a positive example of security processes working as intended in the crypto industry.
Developers and technically minded readers may want to review RippleX’s official disclosure report, which documents the full technical details. Anyone running or auditing their own blockchain projects should treat this case as a reminder to regularly re-examine existing codebases — even seemingly stable, battle-tested components — using new methods, including AI-assisted ones. Security architecture isn’t a one-time project; it’s an ongoing process that has to evolve alongside the tools available to analyze it. The Nasdaq listing of XRP treasury company Evernorth likewise shows just how much institutional confidence in the XRP Ledger’s technical stability has grown.
