XRP Ledger Flaw Could Mint 18 Trillion XRP, RippleX Confirms

An AI agent built by Veria Labs identified a chained vulnerability in the XRP Ledger that could have created roughly 18 trillion XRP in a single transaction, approximately 184 times the asset’s original 100 billion supply. RippleX confirmed the flaw and issued an emergency patch within days of the report.

Veria Labs AI Agent Identifies an XRP Ledger Flaw

Veria Labs says its AI agent flagged a chained vulnerability in the XRP Ledger payment engine that, if exploited, would have allowed a single crafted payment to mint roughly 18 trillion XRP, dwarfing the asset’s intended supply ceiling. For related coverage, see Metaplanet Sold 10,000 BTC, Bought 11,000 at 9.3% Higher Price.

Veria Labs said the fixed-supply XRP market, valued at approximately $94 billion at the time of its report, was potentially exposed if counterfeit XRP entered circulation. XRP was trading at $1.39 at the time of research capture, with a current market cap near $87.6 billion.

What the 18 Trillion XRP Exposure Means

An uncontrolled minting event of this scale would have invalidated XRP’s core value proposition: a verifiably finite supply. Supply credibility is central to exchange listings, institutional custody, and payment-network settlement; counterfeited tokens entering circulation would have made every existing balance suspect. For related coverage, see Bitcoin Price Under Pressure After Houthi Attack.

Veria Labs says the XRPL bug bounty program paid the $250,000 maximum for the AI-discovered vulnerability, indicating it was treated as a critical severity finding.

RippleX Confirms the Issue and Its Significance

RippleX’s official disclosure confirms a signed 64-bit integer overflow in the payment offer-aggregation engine, combined with a matching overflow in the XRPNotCreated invariant check, could allow minted XRP to pass validation and be spent. The bug had likely existed since the code was written in 2015, according to the report.

The vulnerability was reported on September 22, 2026. RippleX reproduced the exploit locally and coordinated the response with the XRPL Foundation and validators, per CryptoSlate’s reporting. The fix shipped as an emergency release outside the normal amendment process three days later.

RippleX says xrpld 3.4.1 was released September 25, 2026, addressing all versions 3.4.0 and earlier. The report found no evidence of exploitation on public networks.

Confirmed Vulnerability Versus Hypothetical Minting Outcome

RippleX confirmed the flaw exists and was exploitable; it did not confirm that any unauthorized XRP was ever minted on a public network. The distinction matters for exchanges, validators, and holders assessing whether existing ledger state is trustworthy. Operators running xrpld 3.4.0 or earlier should upgrade immediately. The XRP Ledger fix for unlimited XRP minting is now publicly documented.

Why This XRP Ledger Disclosure Matters for Crypto Markets

The XRP Ledger has previously expanded its feature set, including adding granular transaction permissions and primary signing key controls. A supply-integrity flaw of this severity, sitting undetected since 2015, raises broader questions about long-standing payment-engine code across similar ledger implementations.

Supply Credibility, Market Confidence, and Next Steps

The Crypto Fear & Greed Index stood at 61 (Greed) at time of writing, suggesting broader market sentiment has not yet priced in significant protocol-level risk from this disclosure. Validators and custodians who have confirmed their upgrade to xrpld 3.4.1 will be the clearest short-term signal that the network is operating on patched infrastructure.

Readers should monitor RippleX’s post-patch audit reports for any retrospective on-ledger analysis confirming no supply anomalies exist in historical transaction data. An official all-clear from the XRPL Foundation would be the authoritative close to this incident, separate from the vulnerability confirmation already on record. Separately, the Ledger hardware wallet supply-chain incident earlier this year underscored that crypto infrastructure vulnerabilities rarely surface through conventional audits alone, reinforcing the case for AI-assisted security review.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.