An integer-overflow bug that sat in the XRP Ledger for roughly a decade could have allowed an attacker to mint billions of new XRP and break the cryptocurrency's 100 billion token supply cap, the XRP Ledger Foundation disclosed on Monday. RippleX, which shipped the patch, said it found no evidence of exploitation or unauthorized token creation on any public network.

Researcher Cayden Liao and Veria AI uncovered the vulnerability and reported it internally on Sept. 22. The flaw is believed to have existed since 2015. No new XRP was created, and about 99.986 billion XRP remain in circulation today, according to the foundation.

The stakes were structural rather than incidental. The XRP Ledger (XRPL) is an open-source, decentralized layer-1 blockchain whose native token was designed so that no new coins can ever be minted. XRP pays transaction fees and bridges currency trades on the ledger's built-in decentralized exchange. A workable minting exploit would have invalidated the ledger's core scarcity guarantee — the 100 billion coins created at the blockchain's debut in 2012.

How did the exploit work?

The vulnerability behaved like an old arcade game's score counter: once a value exceeded the system's maximum numerical limit, it wrapped around to near zero. In practice, that meant a transaction sized beyond the limit would register a total cost of a fraction of a cent while seller accounts received their full XRP amounts, bypassing standard fund checks.

An attack would have required hundreds of carefully constructed operations. The attack sequence:

• Set up dummy accounts posting fake token sales denominated in astronomical amounts of XRP
• Act as the buyer and purchase all posted tokens in a single operation, paying in XRP
• Let the wrapped total charge the buyer almost nothing while the ledger credited the seller accounts with billions of valid XRP

The difference would have been minted out of thin air, artificially inflating total supply. The attacker could then have liquidated the newly created XRP on external exchanges.

Why did the checks miss it?

The bug survived for years because ordinary activity never approached the trigger threshold. "No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations," the foundation said in its explainer.

The ledger's own safeguards also failed to catch it. As CoinDesk reported, the post-transaction check that confirms no new XRP has appeared relied on the same miscounted total, so it registered nothing unusual. A separate per-account receiving limit never fired either, because the attack would have distributed the XRP across hundreds of accounts.

The foundation added that artificial intelligence is accelerating vulnerability discovery for "the bad guys and the good guys." Going forward, it plans to apply AI adversarial testing aggressively, implement formal verification of core ledger logic and strengthen its bug bounty program. "You'll hear a lot more about this as we progress," the foundation said.

The episode is likely to sharpen scrutiny of legacy ledger code paths where edge conditions, not design intent, define security boundaries. For XRPL validators and institutional integrators, the immediate operational question is whether other overflow-prone arithmetic paths surface under the foundation's expanded adversarial testing in the coming months.