A bug hidden since 2015 could have created around 18 trillion $XRP in a single transaction. That’s ~184 times the maximum supply of 100 billion. It was fixed… without the usual validator vote. And that’s the real debate.
📋 The facts (XRPL report, The Block, Cointelegraph)
• Sept. 22: Veria Labs reports the vulnerability through the bug bounty program (maximum reward $250,000; found with the help of an AI agent, according to its co-founder)
• Sept. 25: emergency patch xrpld 3.4.1, active as soon as it’s installed
• Normally: >80% of trusted validators for 2 weeks
• A first in more than 10 years
• No evidence of exploitation on a public network
How it works 👇
An “integer overflow”: like a counter that goes past its maximum and starts again near zero. With hundreds of rigged offers followed by a single payment, sellers would be paid in full while the buyer paid only a few crumbs. The difference = XRP created out of thin air.
Why skip the vote? The code is public: a 2-week vote would have shown the vulnerability to hackers.
A caveat: the XRPL Foundation says the decision was made with RippleX, developers, and validators, and that each operator remained free to install the update. But the compiled software was released before the source code, which is controversial.
🌍 For Esther, in Kinshasa
She keeps a little XRP on a platform. There’s no trace of exploitation, so no need to panic. But the lesson applies to all crypto:
1. “Decentralized” doesn’t mean “no humans making decisions”
2. A “fixed” supply is only guaranteed if the code is correct
3. Check who can take action in an emergency on the network you use
What about you: fix it quickly in secret, or wait for the vote and risk an attack? 👇
Not financial advice. DYOR.
Sources: XRPL.org; The Block; Cointelegraph; Gizmodo (Oct. 2026).
#XRP #CryptoSecurity #Africa
📋 The facts (XRPL report, The Block, Cointelegraph)
• Sept. 22: Veria Labs reports the vulnerability through the bug bounty program (maximum reward $250,000; found with the help of an AI agent, according to its co-founder)
• Sept. 25: emergency patch xrpld 3.4.1, active as soon as it’s installed
• Normally: >80% of trusted validators for 2 weeks
• A first in more than 10 years
• No evidence of exploitation on a public network
How it works 👇
An “integer overflow”: like a counter that goes past its maximum and starts again near zero. With hundreds of rigged offers followed by a single payment, sellers would be paid in full while the buyer paid only a few crumbs. The difference = XRP created out of thin air.
Why skip the vote? The code is public: a 2-week vote would have shown the vulnerability to hackers.
A caveat: the XRPL Foundation says the decision was made with RippleX, developers, and validators, and that each operator remained free to install the update. But the compiled software was released before the source code, which is controversial.
🌍 For Esther, in Kinshasa
She keeps a little XRP on a platform. There’s no trace of exploitation, so no need to panic. But the lesson applies to all crypto:
1. “Decentralized” doesn’t mean “no humans making decisions”
2. A “fixed” supply is only guaranteed if the code is correct
3. Check who can take action in an emergency on the network you use
What about you: fix it quickly in secret, or wait for the vote and risk an attack? 👇
Not financial advice. DYOR.
Sources: XRPL.org; The Block; Cointelegraph; Gizmodo (Oct. 2026).
#XRP #CryptoSecurity #Africa