For eleven years, a bug sat inside the XRP Ledger’s payment engine that could have minted roughly 18 trillion XRP, about 180 times the token’s entire 100 billion supply, in a single transaction, by security researcher Cayden Liao’s estimate. The XRP Ledger Foundation disclosed the flaw on October 9 in its vulnerability disclosure report, three days after researcher Cayden Liao and security firm Veria Labs reported it through the ledger’s bug bounty program. The fix shipped September 25 in xrpld 3.4.1, and developers found no sign anyone had used the flaw to create XRP on a live network.
How the wrap-around worked
The ledger tracks XRP balances as 64-bit whole numbers capped at a set ceiling. Per the disclosure, once a running total pushed past that ceiling the arithmetic rolled over to a much smaller value rather than stopping the payment. A payment that filled hundreds of order book offers had no check on its total, so a huge sum could quietly become a tiny one: sellers were paid in full while the buyer was charged almost nothing, leaving new spendable XRP behind.
The attack was cheap to set up and impossible to trigger by accident. The report states: “The attack could not be triggered by accident. It required hundreds of offers priced in a way no real trader would use, followed by a payment built specifically to consume them all at once.” Opening the accounts needed only a few hundred XRP, most of it recoverable, plus transaction fees.
Why two safety nets missed it
The ledger already runs a check after every transaction to make sure no new XRP has appeared. That check relied on the miscounted total, the disclosure explains, so it would have passed anyway. A separate limit on how much XRP a single account can receive would not have triggered either, because the attack spread the new tokens across hundreds of accounts.
Engineers at RippleX reproduced the attack on a standalone server and confirmed the newly created XRP could be spent in a later transaction. About 99.986 billion XRP exist today, all of it created at the ledger’s 2012 launch, with fees burned along the way, so the supply is deflationary.
Krishi is a seasoned tech journalist with over four years of experience writing about PC hardware, consumer technology, and artificial intelligence. Clarity and accessibility are at the core of Krishi’s writing style. He believes technology writing should empower readers—not confuse them—and he’s committed to ensuring his content is always easy to understand without sacrificing accuracy or depth. Over the years, Krishi has contributed to some of the most reputable names in the industry, including Techopedia, TechRadar, and Tom’s Guide. A man of many talents, Krishi has also proven his mettle as a crypto writer, tackling complex topics with both ease and zeal. His work spans various formats—from in-depth explainers and news coverage to feature pieces and buying guides. Behind the scenes, Krishi operates from a dual-monitor setup (including a 29-inch LG UltraWide) that’s always buzzing with news feeds, technical documentation, and research notes, as well as the occasional gaming sessions that keep him fresh. Krishi thrives on staying current, always ready to dive into the latest announcements, industry shifts, and their far-reaching impacts. When he’s not deep into research on the latest PC hardware news, Krishi would love to chat with you about day trading and the financial markets—oh! And cricket, as well.
View all articles by Krishi Chowdhary
The Tech Report editorial policy is centered on providing helpful, accurate content that offers real value to our readers. We only work with experienced writers who have specific knowledge in the topics they cover, including latest developments in technology, software, hardware, and more. Our editorial policy ensures that each topic is researched and curated by our in-house editors. We maintain rigorous journalistic standards, and every article is 100% written by real authors.
Discover more from PMN S.P.O.R.T.S - A PRIME MEDIA NETWORK BRAND
Subscribe to get the latest posts sent to your email.
