# XRP Ledger patched an overflow bug that could have created up to 18 trillion new XRP, and its foundation says supply was not affected

The flaw sat in the order-book payment math for about a decade, earned researchers a $250,000 bounty, and was fixed quietly in version 3.4.1 before it was made public.

- Published: 2026-10-12T05:41:53.098Z
- Canonical: https://polylog.news/crypto/2026-10-12/xrp-ledger-patched-an-overflow-bug-that-could-have-created-u
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/xrp-ledger-confirms-100b-supply-is-safe-after-major-security-flaw/), [Polylog editors](https://polylog.news), [KuCoin News](https://www.kucoin.com/news/flash/xrp-ledger-foundation-clarifies-security-patch-misunderstandings-no-xrp-inflation), [TokenPost](https://www.tokenpost.com/news/technology/29434)

The XRP Ledger Foundation, which supports the open-source XRP Ledger, [said no new XRP was created](https://t.me/cointelegraph/72608) by a recently patched ledger bug. Supply stays capped at 100 billion, and the fix shipped in version 3.4.1. [crypto.news reports](https://crypto.news/xrp-ledger-confirms-100b-supply-is-safe-after-major-security-flaw/) that the bug was about ten years old, could in theory have minted 18 trillion XRP, and earned the researchers who found it a $250,000 bounty. The foundation also found no evidence that anyone exploited it before the patch.

The root cause was an integer overflow. A payment can draw on many offers in the ledger's built-in order book. According to the [foundation's explanation](https://www.kucoin.com/news/flash/xrp-ledger-foundation-clarifies-security-patch-misunderstandings-no-xrp-inflation), the code added up those amounts in an unchecked 64-bit integer. When the total exceeded the largest value the integer can hold, it wrapped around to a much smaller number, but sellers still received their full amounts. The gap between the two would have been new XRP. The foundation says triggering the flaw would have required hundreds of deliberately crafted operations, so ordinary payments could not set it off.

The disclosure followed an unusual order. The patch went into version 3.4.1 about two weeks before the public explanation, and maintainers held back details to avoid giving attackers, including those using artificial-intelligence tools, a guide to the flaw. Reports credit the discovery to Veria AI, working through the bounty program. [TokenPost](https://www.tokenpost.com/news/technology/29434) also describes it as a decade-old defect. A quiet patch works on the XRP Ledger because a relatively small set of validators on the recommended list can upgrade together. That same coordination, which protected users here, also reflects how concentrated the network's governance is.

## What this means

A fixed supply is only as strong as the arithmetic that enforces it, and the exposure here was to XRP's monetary premise itself, not to any single application. Bitcoin's 2010 value-overflow incident, which briefly created more than 184 billion BTC and was reversed with an emergency fork, and Zcash's 2018 counterfeiting flaw, which was fixed in secret and disclosed months later, show the pattern: inflation bugs in mature chains are found late and fixed quietly. The market has not reacted, and that looks correct, since the foundation's supply figures are checkable on-chain. The forward read is more about process than about XRP. AI-assisted bug hunting is finding old defects in base-layer code faster than maintainers have historically disclosed them. The likelier outcome over the coming months is more silent patches followed by delayed disclosure across older chains. That depends on validators continuing to upgrade quickly. A disclosed inflation bug that was exploited before a patch landed would overturn the market's current calm.

## What to watch

- Whether independent researchers publish their own reconciliation of total XRP supply against the foundation's figure. Matching numbers would close the question of whether the flaw was ever used.
- How many XRP Ledger validators and node operators are still running versions older than 3.4.1. Unpatched nodes would remain exposed now that the details are public.
- More bounty disclosures on older base-layer codebases that credit AI-assisted tools. A steady flow would confirm that machine-assisted review is surfacing a backlog of old bugs.