XRP has a fixed supply of 100 billion coins. That number is one of the few things holders assume they never have to check. On October 9, 2026, XRP Ledger developers disclosed that, for roughly a decade, a bug in the ledger’s payment engine could have let an attacker create spendable XRP out of nothing — and that it had been quietly patched two weeks earlier.
Developers say there is no evidence it was ever used. The way it was fixed, though, is a first for the network, and the bug itself is a sharp reminder that “hard caps” are enforced by code, not by marketing.
Key facts
- A 2015-era overflow bug in the XRP Ledger payment engine could have created XRP beyond the 100 billion cap when one payment consumed many offers on the built-in DEX.
- Cayden Liao and Veria AI reported it on September 22, 2026; RippleX reproduced it and raised it to critical on September 23; xrpld 3.4.1 shipped on September 25.
- More than 80% of default-UNL validators were running 3.4.1 on September 25, 2026.
- The fix skipped the usual amendment vote, the first such change since the amendment system launched, because a vote would have revealed the exploit.
- XRPL Operations said it found “no evidence that this issue was exploited on any public network”; disclosure came on October 9 when the fixBatchV1_2 amendment went live.
- XRP traded around $1.40 on October 10, 2026, up 0.6% on the day and down about 5.5% on the week.
What was the XRP Ledger overflow bug?
The bug sat in how the XRP Ledger added up amounts when a single payment crossed many offers on its built-in decentralized exchange. The sums were computed with 64-bit integers and no overflow checks, so a large enough total could wrap around to a tiny number — paying sellers in full while charging the buyer almost nothing.
As Bitcoin.com explains, the result would have been XRP that never existed: sellers received their full amounts, the buyer’s balance barely moved, and the difference appeared from nowhere. The code dates back to around 2015.
What made it worse is the safety net. The XRP Ledger runs an invariant check designed to catch any unauthorized creation of XRP. According to Bitcoin.com and The Crypto Basic, that check relied on the same unchecked arithmetic, so it would have missed the problem it was built to catch.
How expensive would an attack have been?
Not very. Bitcoin.com puts the cost at a few hundred XRP in reserves, most of it recoverable, plus normal transaction fees. CoinDesk’s headline on October 10 described a bug that could have created “billions of dollars worth of XRP from nothing.”
A supply cap is a promise written in code. This one had a typo.
How was it fixed without telling attackers?
RippleX shipped a patched node release, xrpld 3.4.1, on September 25, 2026, and validators adopted it before the vulnerability was made public. The usual route — an amendment that needs more than 80% validator support for two weeks — was skipped, because putting the change to a public vote would have revealed the exploit to anyone watching.
The timeline was fast. Cayden Liao and Veria AI reported the issue on September 22 and rated it “Major.” RippleX reproduced it and raised it to critical the next day. Two days later the fix was out, and more than 80% of default-UNL validators were running it that same day.
The Crypto Basic notes that this is the first change to bypass the amendment vote since the amendment system launched. Public disclosure followed on October 9, when the fixBatchV1_2 amendment went live; a separate, lower-severity bug in the Batch feature was fixed in the same release.
The trade-off
Silent patching protected the network. It also means a small group of developers and validator operators decided, out of public view, to change node software on a network that normally votes on such changes. Most observers will see that as the right call for a critical bug. It is still worth noting that the emergency path exists and has now been used.
Was any XRP actually created?
According to XRP Ledger developers, no. XRPL Operations said, “We have found no evidence that this issue was exploited on any public network.” The bug was reported privately, reproduced, patched within three days and adopted by most validators before disclosure, which left little window for anyone else to find and use it.
The market reaction was muted. Per SpendNode, XRP was around $1.40 on October 10, up 0.6% on the day and about 5.5% lower over the week. Price moves are reported for context only; this is not financial advice.
What it means for swap users
Bugs like this sit below every wallet, exchange and swap service — no front-end can see them. Last month’s Symbiosis bridge exploit, where fake syBTC was minted, showed what happens when unchecked minting does get exploited. On SwapZilla there is no account and no balance: each swap goes straight to your wallet, and you can compare quotes from several licensed providers or CEX and DEX routes on the DEX shelf. That doesn’t protect you from a protocol bug, but it keeps your funds from sitting on one platform while one is being patched. More on the risks in our guide to swapping safely across chains.
Final thoughts
The XRP Ledger overflow bug is a good-news story with an uncomfortable middle. A decade-old flaw that could have broken the 100 billion cap was found by outside researchers, confirmed in a day, patched in three and, according to developers, never exploited.
The uncomfortable part is how long it sat there, and that the check designed to catch it shared the same blind spot. Fixed supply is only as fixed as the arithmetic behind it — and the people auditing it.