XRPL Vulnerability Could Have Minted 18T XRP, Fixed in xrpld 3.4.1

In the latest Ripple news, the XRP Ledger Foundation and RippleX disclosed a payment-engine vulnerability that could theoretically have created approximately 18 trillion spendable XRP in one transaction, far exceeding the ledger’s intended 100 billion XRP supply.

The disclosure says there was no evidence that the flaw was exploited on a public network or that unauthorized XRP was created; it was fixed in xrpld 3.4.1.

This was a supply-integrity risk, not a confirmed supply breach. Under specially constructed payment conditions, the XRPL vulnerability could have caused the ledger to credit more XRP than a buyer paid; an existing safety check failed to identify the difference.

It's official.

XRP Ledger patches a decade-old overflow bug in its payment engine that could have let an attacker mint about 18 trillion spendable XRP in a single transaction. pic.twitter.com/mP6Mv6fkTK

— MSB Intel (@MSBIntel) October 11, 2026

The payment engine can consume offers from the order book as one payment crosses a trading path. The disclosure says an unchecked integer overflow could occur when adding amounts from many offers: once the sum exceeded the fixed maximum of the integer representation, it wrapped to a small value instead of producing an error.

That arithmetic mismatch mattered because the engine still paid each offer owner the full amount individually, while charging the buyer only the wrapped total. The difference would have amounted to newly created XRP. The ledger’s “no XRP created” invariant was also based on arithmetic that wrapped in the same way, so it did not catch the discrepancy.

The vulnerability affected xrpld 3.4.0 and earlier. It was reported through the XRPL Bug Bounty program on September 22, 2026, and the report says the flaw may have been present since the current payment engine was written in 2015. The October 9 vulnerability disclosure says the fix shipped in xrpld 3.4.1, released on September 25.

Market Intelligence: Crypto Analyst Predicts Best New Crypto to Hodl

The reported figure of approximately 18 trillion XRP describes what the vulnerability could theoretically have enabled in a single transaction. It is roughly 180 times the ledger’s intended 100 billion supply. The disclosure explicitly says investigators found no evidence of exploitation on a public network or unauthorized XRP creation.

Triggering the flaw required specially crafted offers and a payment designed to consume many of them together. It was not an accidental outcome of ordinary payments or trades. The available disclosure does not report confirmed public-network compromise or lost funds, and the potential scale should not be mistaken for an observed market or supply event.

In xrpld 3.4.1, the payment engine checks for overflow while summing offer amounts and fails the affected payment path if the sum would exceed the limit. The disclosure also says the no-XRP-created safety check now uses a wider counter, alongside hardening in other balance-summing code.

XRP Ledger version 3.4.1 is now the minimum required version after the recent amendments were activated.

This release patched critical parts of the XRP Ledger.

The vulnerability report can be found here:https://t.co/sYIwuDomjY
Public release notes:https://t.co/JqX4UYDDg6pic.twitter.com/pH9Gnsnpqi

— XRP Ledger Operations (@XRPLOperations) October 10, 2026

Two bugs were fixed in xrpld 3.4.1. The second involved validation of inner transaction wrappers in Batch transactions and affected xrpld 3.3.0 and 3.4.0; the BatchV1_1 amendment was not active on Mainnet when that issue was found. It is separate from the payment-engine overflow and should not be read as evidence that the same conditions affected both bugs.

The disclosure describes a narrow but important security lesson: a safety check can fail if it repeats the same unsafe arithmetic as the transaction logic it is meant to verify.

According to the latest Ripple news, the practical issue was not merely that a payment calculation could overflow, but that the independent check intended to protect supply integrity could overflow alongside it.

Market Intelligence: Crypto Analyst Predicts Best Low-Cap Crypto

The post Ripple News: A Hidden XRPL Bug Could Have Printed 18T XRP appeared first on Coinspeaker.