🚨 The “money-printing machine” bug that lay dormant for 11 years: $XRP could almost have been conjured out of thin air
A security report published by the XRP Ledger community on October 9 was followed up by CoinDesk today: a payment-engine integer overflow vulnerability had been lurking since 2015.
In plain English: an attacker could open hundreds of accounts, place a bunch of absurd offers like “trade 10 cents for a fortune in $XRP ,” then sweep them all up in a single payment. When the ledger calculated the total, the number would overflow and wrap to zero. Sellers would receive the full amount, while buyers would get almost everything for free—the difference would be XRP conjured out of thin air.
😱 Keep in mind that $XRP ’s hard cap of 100 billion tokens is built into its DNA. This bug was basically a backdoor to the money-printing machine.
Three pieces of good news worth celebrating:
① On September 22, white-hat researchers Cayden Liao and Veria AI reported the issue through the bug bounty program. xrpld 3.4.1 was quietly patched on September 25—just three days from report to fix.
② On the day of the fix, over 80% of validators on the default trusted list had already upgraded.
③ RippleX reproduced and confirmed the issue on an isolated server: there is currently no evidence that any mainnet was exploited.
One small downside: this fix bypassed the usual amendment vote—for the first time in over a decade, suggesting the officials themselves were pretty shaken up.
#XRP holders, does this story of a “near-bypass of the hard supply cap” count as the year’s most hair-raising security incident? Let’s discuss in the comments 👇
For informational purposes only; not investment advice
A security report published by the XRP Ledger community on October 9 was followed up by CoinDesk today: a payment-engine integer overflow vulnerability had been lurking since 2015.
In plain English: an attacker could open hundreds of accounts, place a bunch of absurd offers like “trade 10 cents for a fortune in $XRP ,” then sweep them all up in a single payment. When the ledger calculated the total, the number would overflow and wrap to zero. Sellers would receive the full amount, while buyers would get almost everything for free—the difference would be XRP conjured out of thin air.
😱 Keep in mind that $XRP ’s hard cap of 100 billion tokens is built into its DNA. This bug was basically a backdoor to the money-printing machine.
Three pieces of good news worth celebrating:
① On September 22, white-hat researchers Cayden Liao and Veria AI reported the issue through the bug bounty program. xrpld 3.4.1 was quietly patched on September 25—just three days from report to fix.
② On the day of the fix, over 80% of validators on the default trusted list had already upgraded.
③ RippleX reproduced and confirmed the issue on an isolated server: there is currently no evidence that any mainnet was exploited.
One small downside: this fix bypassed the usual amendment vote—for the first time in over a decade, suggesting the officials themselves were pretty shaken up.
#XRP holders, does this story of a “near-bypass of the hard supply cap” count as the year’s most hair-raising security incident? Let’s discuss in the comments 👇
For informational purposes only; not investment advice