A vulnerability that went unnoticed for 11 years could have conjured XRP out of thin air—and yet XRP is up today.
On October 9, XRPL developers publicly disclosed an integer overflow vulnerability in the payment engine that could be traced back to 2015. An attacker would only need to open a few hundred accounts, each placing a sell order to exchange “a small amount of tokens for a huge amount of XRP,” then use a single payment to take all the orders at once. The total would be so large that it would “overflow the software’s counter back to zero.” Sellers would receive the full amount, while the buyer would pay next to nothing. The difference would be XRP created out of thin air—and it could be transferred and deposited at exchanges as usual.
The vulnerability was reported on September 22 by researcher Cayden Liao and Veria AI through the official bug bounty program. An emergency fix, xrpld 3.4.1, was released on September 25 (the patch came first, with details disclosed two weeks later). RippleX confirmed there was no evidence of exploitation on the public network. The 100 billion token supply cap was preserved.
My take: Releasing the patch before the details is standard security practice, and it was handled very professionally here—the goal is to prevent attackers from exploiting the bug after disclosure. The market didn’t panic; instead, XRP rose 1%, suggesting the market’s view is: “The vulnerability has been patched, and nothing happened.” A risk event has instead become proof of resilience. A public blockchain that has now shown it can uphold its supply rules has an even stronger long-term case. But don’t get complacent: the vulnerability stayed hidden for 11 years, showing that the audit coverage of XRPL’s legacy code still has blind spots. A string of security issues in similar legacy infrastructure has surfaced recently—a warning for the whole industry. There are also several near-term events for XRP: XRPN opens on Nasdaq on Monday, and CPI is released Wednesday. Volatility around $1.40 could be significant.
Data as of: 2026-10-10 18:54 UTC
Sources: CoinDesk; CoinEdition
For informational purposes only; not investment advice.
$XRP #XRPL
Would you avoid this coin just because its blockchain had a vulnerability?
On October 9, XRPL developers publicly disclosed an integer overflow vulnerability in the payment engine that could be traced back to 2015. An attacker would only need to open a few hundred accounts, each placing a sell order to exchange “a small amount of tokens for a huge amount of XRP,” then use a single payment to take all the orders at once. The total would be so large that it would “overflow the software’s counter back to zero.” Sellers would receive the full amount, while the buyer would pay next to nothing. The difference would be XRP created out of thin air—and it could be transferred and deposited at exchanges as usual.
The vulnerability was reported on September 22 by researcher Cayden Liao and Veria AI through the official bug bounty program. An emergency fix, xrpld 3.4.1, was released on September 25 (the patch came first, with details disclosed two weeks later). RippleX confirmed there was no evidence of exploitation on the public network. The 100 billion token supply cap was preserved.
My take: Releasing the patch before the details is standard security practice, and it was handled very professionally here—the goal is to prevent attackers from exploiting the bug after disclosure. The market didn’t panic; instead, XRP rose 1%, suggesting the market’s view is: “The vulnerability has been patched, and nothing happened.” A risk event has instead become proof of resilience. A public blockchain that has now shown it can uphold its supply rules has an even stronger long-term case. But don’t get complacent: the vulnerability stayed hidden for 11 years, showing that the audit coverage of XRPL’s legacy code still has blind spots. A string of security issues in similar legacy infrastructure has surfaced recently—a warning for the whole industry. There are also several near-term events for XRP: XRPN opens on Nasdaq on Monday, and CPI is released Wednesday. Volatility around $1.40 could be significant.
Data as of: 2026-10-10 18:54 UTC
Sources: CoinDesk; CoinEdition
For informational purposes only; not investment advice.
$XRP #XRPL
Would you avoid this coin just because its blockchain had a vulnerability?