XRP Ledger bug that could mint XRP from nothing was patched in secret; foundation defends skipping the vote

A bug in the XRP Ledger that could have created new XRP out of nothing, breaking its fixed supply of 100 billion tokens, was found and quietly patched last month, and the network's developers are now defending the unusual way they fixed it. The flaw had been in the ledger's payment engine since 2015, CoinDesk reported, and developers say there is no evidence it was ever exploited on a public network.

How the XRP bug worked

• The flaw: XRP balances are stored as 64-bit numbers with a fixed ceiling. When a sum went over it, the number wrapped round to a small value instead of failing, an "integer overflow".
• The attack: someone could set up hundreds of specially priced offers on the ledger's built-in exchange, each asking for a huge amount of XRP, then send one payment that filled them all. The buyer would pay only the small wrapped total, while the offer owners were credited in full, creating new XRP that could be spent.
• The limits: it needed deliberately built offers and could not be triggered by normal trading, according to the project's disclosure.

Researcher Cayden Liao and Veria AI reported it on 22 September. RippleX, Ripple's developer arm, rebuilt the attack on a test server and confirmed the minted XRP could be spent later.

Why the patch is controversial

The fix shipped in xrpld 3.4.1 on 25 September, three days after the report, and took effect on any server that installed it. Normally a change like this goes through an amendment vote that needs more than 80 percent of validators for two weeks. Developers said this was the first deliberate bypass of that process in more than ten years, because "with a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security", Cointelegraph reported.

• The critics: Cyber Capital founder Justin Bons said the release came as binaries only, with the source code held back for a time, and that selling XRP to retail investors as decentralised was "straight-up fraud".
• The defence: the XRP Ledger Foundation said the call was made jointly by the foundation, RippleX, core developers and validators, and that "no single party could make that call alone". Independent validator XRP Kuwait said "coordination is not the same as control".

What it means if you hold XRP in Pakistan

You do not need to do anything: the fix sits in the software that runs the network, not in your wallet. The bigger lesson is about risk. A coin can carry a hidden flaw for a decade, and the people who run it can change the rules quickly when they must. Keep only what you can afford to lose, use a reputable exchange or your own wallet, and compare prices in rupees before you buy: our bitcoin price page and currency converter help with the arithmetic. Gains on crypto may also be taxable; see the capital gains tax calculator.