XRP Ledger fixes a 2015-era bug that let a payment create spendable XRP without funding it

Developers of the XRP Ledger have disclosed and fixed a flaw that dates to 2015. The flaw could have let an attacker create spendable XRP without funding it, which would break the asset's fixed supply of 100 billion tokens. Researchers showed that a single payment could produce XRP the sender never held. The disclosure led to an emergency software release.

The demonstrated attack used three accounts. The attacker funded two of them and left the third unfunded. The attacker then built a batch transaction with three parts: a payment that creates the unfunded account, a simple transaction from that new account, and a payment from the victim account to the attacker. The researcher Cayden Liao and the security firm Veria AI reported the bug internally on Sept. 22. RippleX, Ripple's engineering arm, said it found no evidence that anyone used the flaw on public networks. It shipped the fix in xrpld version 3.4.1 on Sept. 25. The trading-news channel BWE News carried the disclosure to Chinese-language readers within minutes.

The timing matters because the Batch feature itself just went live. Batch activated on mainnet with support from 30 validators, according to crypto.news. It lets users bundle between two and eight transactions into one operation. This is the second serious finding tied to Batch this year. In February, an automated AI security tool found a signature-validation flaw in the Batch amendment. That flaw would have let an attacker run inner transactions for any account without its private key. Ripple responded with rippled 3.1.1, which marked Batch as unsupported before it could activate.

Neither bug cost anyone money. But both show the same pattern. A new feature that combines several operations atomically creates code paths that older rules about balances and account creation were never written to handle.