The XRP Ledger Foundation moved to clear up questions and misconceptions raised by the recent security fix, saying in a post on X that no XRP was created: the supply was fixed at 100 billion when the XRP Ledger launched and no transaction is allowed to create more — the bug was a way around that rule, and 3.4.1 fixed it two weeks ago. Users don't need to take the Foundation's word for it, it said, since all ledger data is public and explorers and data sites read it every day; new XRP would show up in account balances for everyone to see, and there is no hidden place for XRP on the XRP Ledger. The Foundation monitors the ledger 24/7 and has verified the supply throughout the ledger's history, with others in the community verifying it too and anyone able to do the same. Transaction fees are destroyed, so the supply is deflationary, with about 99.986 billion XRP existing today.

On how the bug went unnoticed, the Foundation said no normal payment comes anywhere near triggering it — it took hundreds of deliberately constructed operations — and that AI makes bugs like this faster to find, for the bad guys and the good guys. Together with RippleX and the community, it will ensure the XRP Ledger is protected against such vulnerabilities by radically applying formal verification and AI adversarial testing, collaborating closely with security researchers, and strengthening the bug bounty program, with a lot more to come as work progresses.

Decentralization sits at the core of the episode, the Foundation said: a public fix shows attackers where the bug is, and AI makes that fast, so under a normal amendment vote the fix would have been public for weeks before taking effect, risking network security. In response, the XRPL community came together — the XRP Ledger Foundation, RippleX, core developers and validators formed a social consensus and agreed on a path involving shipping the fix directly, with the plan also designed to minimize disruption for everyone running on the network. The build was shared with default UNL validators using the contact details each publishes in its xrp-ledger.toml file, and public binaries followed the same day, September 25. No single party could make that call alone: every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks — protocol changes still go through amendments.