The XRP Ledger has patched a bug that, for nearly a decade, could have let attackers create new, spendable XRP beyond its hard cap of 100 billion coins. The flaw was an integer overflow in the ledger’s payment engine, meaning the software could wrap past its maximum number and return a false result. In practice, that could have tricked the ledger into accepting XRP beyond the supply limit and let those excess coins move through network transactions.
RippleX said the flaw was serious enough to create spendable XRP if exploited, and investigators were able to reproduce it on an isolated server. But checks of public networks found no sign that it had ever been abused. The bug appears to date back to at least 2015, which is why this matters: a supply-breaking flaw sat in production code on a major ledger for years before xrpld 3.4.1 patched it.