security flaw

XRP Ledger discloses overflow bug that could have minted XRP beyond its supply cap

8Importance
closedStatus
6News media
7Pieces
Published
In
XRP

XRP Ledger disclosed a software flaw in its payment engine that could have let someone create spendable XRP outside the intended supply cap. The issue was reported across October 9 and Friday coverage, and one report says the fix was released in xrpld 3.4.1 after testing showed unauthorized XRP creation. Another report says RippleX found no sign the flaw was used.

Key claims & sources

✓
On October 9, 2026, the XRP Ledger disclosed two software vulnerabilities, including one that could have allowed the creation of new, spendable XRP.
✓
A security report published Friday said a payment-software flaw in the XRP Ledger could have let an attacker create spendable XRP, and that the bug had likely gone unnoticed since 2015.
✓
RippleX said it found no sign that anyone used the flaw.
✓
Researchers demonstrated unauthorized XRP creation in testing, and the vulnerability in the payment engine was patched in xrpld 3.4.1.

What it means

Users and holders of XRP notice that the ledger’s supply control was put under scrutiny, because the disclosed flaw concerned the creation of spendable XRP. That matters today because the issue was not just theoretical: researchers demonstrated unauthorized XRP creation in testing, and the patched version is now xrpld 3.4.1.

In practice, the change is that the payment-engine vulnerability has been patched, while the supply cap itself is still described as 100 billion XRP. What remains the same is the ledger’s capped design, but the disclosed bug showed that the software layer around it needed a fix before the limit could be relied on in operation.

Market reaction i

XRPXRP the headline names this asset
first headline
+0.7% 2 h before
0.0% 4 h after
$1.41price at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 10 06:05
+2 min
Oct 10 06:06
Coinpedia adds
Brings into the story: XRPL, with quotes
+29 min
Oct 10 06:33
BeInCrypto adds
Adds $88.8B, with quotes
+4 h 50 m
Oct 10 10:54
U.Today echo
No new facts: unlimited, remediate, unleashed
+5 h 41 m
Oct 10 11:45
Crypto News Flash context
Its angle: decentralized, demonstrated, subsequently
+1 d
Oct 11 06:34
U.Today context
Its angle: following, engineer, uncover
+1 d 8 h
Oct 11 14:08
The Defiant echo
No new facts: trillions, defiant, story