XRP Ledger patched an overflow bug that could have created up to 18 trillion new XRP, and its foundation says supply was not affected

The XRP Ledger Foundation, which supports the open-source XRP Ledger, said no new XRP was created by a recently patched ledger bug. Supply stays capped at 100 billion, and the fix shipped in version 3.4.1. crypto.news reports that the bug was about ten years old, could in theory have minted 18 trillion XRP, and earned the researchers who found it a $250,000 bounty. The foundation also found no evidence that anyone exploited it before the patch.

The root cause was an integer overflow. A payment can draw on many offers in the ledger's built-in order book. According to the foundation's explanation, the code added up those amounts in an unchecked 64-bit integer. When the total exceeded the largest value the integer can hold, it wrapped around to a much smaller number, but sellers still received their full amounts. The gap between the two would have been new XRP. The foundation says triggering the flaw would have required hundreds of deliberately crafted operations, so ordinary payments could not set it off.

The disclosure followed an unusual order. The patch went into version 3.4.1 about two weeks before the public explanation, and maintainers held back details to avoid giving attackers, including those using artificial-intelligence tools, a guide to the flaw. Reports credit the discovery to Veria AI, working through the bounty program. TokenPost also describes it as a decade-old defect. A quiet patch works on the XRP Ledger because a relatively small set of validators on the recommended list can upgrade together. That same coordination, which protected users here, also reflects how concentrated the network's governance is.