The XRP Ledger Foundation has explained how a vulnerability capable of threatening XRP’s 100 billion supply cap remained hidden in the blockchain’s software for years. According to the foundation, regular transaction activity never triggered the specific conditions needed to expose the flaw.

The bug could theoretically have allowed malicious actors to create new XRP without supplying the corresponding funds. The foundation said the vulnerability had persisted in the codebase for more than a decade because ordinary network operations did not come close to activating it.

Researcher Cayden Liao and Veria AI discovered the issue on September 22 and reported it internally. The finding raised concerns because the flaw could have undermined a central feature of the XRP Ledger: its maximum supply of 100 billion tokens, established when the blockchain launched in 2012.

RippleX developed and released a fix. According to the foundation, no additional XRP was created, and there was no reported damage from exploitation. Approximately 99.986 billion XRP remain in circulation.

XRPL is an open-source, decentralized layer-1 blockchain. Its native cryptocurrency, XRP, was designed with a fixed supply rather than a mechanism for creating new tokens. The asset is primarily used to pay transaction fees and facilitate currency exchanges through the ledger’s built-in decentralized exchange (DEX).

The vulnerability, believed to have been present since 2015, could theoretically have bypassed the safeguards protecting that fixed supply.

How the Bug Could Have Enabled XRP Supply Inflation

The flaw involved an “integer overflow,” a programming error that occurs when a numerical calculation exceeds the maximum value a system can represent. Depending on how the software handles the overflow, the value can wrap around to a much smaller number.

In the XRPL case, an excessively large transaction value could have been miscalculated, potentially allowing it to pass standard balance checks. Under the hypothetical exploit, sellers might have received the full XRP amounts associated with their offers while buyers paid almost nothing. The difference could effectively have produced new XRP without a matching payment.

An attacker could have set up dummy accounts and listed fabricated token offers involving enormous amounts of XRP. The attacker could then act as the buyer and attempt to purchase the listed assets in a single operation.

If the exploit worked as described, seller accounts could have been credited with billions of XRP despite the buyer paying only a negligible amount. The attacker might then have attempted to transfer the additional tokens to external exchanges and sell them.

This scenario illustrates the potential impact of the flaw, but it does not mean that new XRP was actually created. RippleX reported no evidence that the vulnerability had been exploited on a public network.

Why XRPL’s Existing Safeguards Did Not Catch It

The foundation said the vulnerability remained undetected because activating it required hundreds of carefully constructed operations at a scale far beyond normal transactions. Typical payments never approached the conditions necessary to trigger the problematic code.

The ledger’s own verification mechanism also relied on the faulty calculation. A check designed to run after transactions and confirm that no new XRP had appeared used the same incorrectly calculated total. As a result, it could overlook the discrepancy it was intended to detect.

A separate safeguard limited the amount of XRP an individual account could receive. However, the theoretical attack could have distributed the tokens across hundreds of accounts, keeping each balance below the individual account threshold.

The incident demonstrates that multiple security checks may not provide sufficient protection when they share the same underlying calculation or when an attacker can structure transactions to avoid individual limits.

AI Security Research Becomes a Priority

The foundation also pointed to artificial intelligence as a growing influence on cybersecurity. AI-assisted tools can help researchers discover overlooked defects in mature software, but similar capabilities could also help attackers locate vulnerabilities and analyze potential exploits more efficiently.

To improve security, the foundation plans to expand AI-powered adversarial testing, introduce formal verification techniques, and strengthen its bug bounty program. These measures are intended to identify hidden weaknesses earlier and improve the reliability of the ledger’s core protections.

Although the vulnerability presented a theoretical threat to XRP’s fixed supply, developers released a correction without evidence of unauthorized token creation. The foundation said additional details about its security initiatives would be shared as the work continues.