Crypto10 October, 20262 min read
RippleX Patched XRPL 3.4.1 Flaw That Could Have Minted Spendable XRP Without Funding
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
A decade-old bug could mint XRP beyond the 100 billion cap. XRPL released emergency 3.4.1 patch on Sept 25 after Sept 22 disclosure.
9 outlets told this the same way.
Overflow Bug Patched
RippleX patched a decade-old flaw in the XRP Ledger payment engine that could have allowed an attacker to create spendable XRP without the sender funding it, violating the ledger’s fixed-supply rule of 100 billion tokens.
RippleX engineers reproduced the attack on a standalone server and confirmed the newly created XRP could be spent in a later transaction, and the ledger’s software is designed so that no more can ever be added.
RippleX said it found no evidence the flaw was exploited on any public network, and developers shipped the fix in xrpld 3.4.1 on Sept. 25 without disclosing what it repaired.
Cayden Liao and Veria AI identified the vulnerability and internally reported it on Sept. 22, and the flaw was believed to date to 2015.
The patch closed a scenario where an attacker could open hundreds of accounts and use the ledger’s built-in exchange so the software would miscount the total XRP owed and charge the buyer almost nothing.
No Exploit Found
RippleX confirmed it found no evidence the vulnerability was ever exploited on any public network, and the reproduced attack demonstrated technical possibility rather than realized damage. The vulnerability stemmed from an integer overflow in the ledger’s number handling, and a security report described how a single payment bundling hundreds of manipulated order-book offers could have generated XRP without a corresponding debit. RippleX shipped the corrected software, xrpld 3.4.1, on September 25, and the patch bypassed the ledger’s customary amendment voting process.
The patch landed while more than 80% of validators on the standard UNL were already running the corrected version or newer, and the fix was applied without the standard amendment voting process for the first time in more than a decade. CoinGape framed the episode as an emergency response that came after the flaw was reported through the XRPL Bug Bounty program on September 22, with RippleX reproducing the exploit on a standalone server.
Institutional Stakes
Institutional demand continued alongside the technical fix, and U.S. spot XRP ETFs logged net inflows of roughly $8 million on Thursday.
“The report does not instruct XRP holders to move their funds or change their private keys.”
Franklin Templeton’s XRPZ fund absorbed about 6 million XRP that day, and the same account flow was described as positive even as other crypto fund categories bled assets.
The sources tied the stakes to supply integrity, noting that the fixed supply of 100 billion XRP was minted at the ledger’s launch in 2012 and that the software is designed so no more can ever be added.
RippleX also continued infrastructure work in parallel, and the PermissionDelegationV1_1 amendment activated on Oct. 8 to let account holders delegate specific operational permissions without exposing primary signing keys.
The disclosure and patching process left node operators with a clear next step, because the advisory required no action from XRP holders while urging operators to update to the patched software or a newer release to stay synchronized with the network.