XRP Ledger Hid a Counterfeiting Bug Since 2015

A decade-old overflow

XRP Ledger maintainers dropped a disclosure Friday: a researcher reported a critical bug through the XRPL bug bounty program in September. The flaw? An integer overflow in the payment engine. It had been hiding since the current payment engine was written in 2015.

Here's the tea: when a single payment chewed through hundreds of specially crafted order-book offers, the buyer's owed total could exceed the max the system stores. That number wrapped around to almost nothing. Sellers got paid in full. Buyers paid almost nothing. The difference? Fresh XRP that should never exist.

Worse, the ledger's "no XRP created" safety check used the same broken arithmetic, so it wrapped too and caught nothing. Maintainers say an attacker could have created spendable XRP far beyond total supply in one transaction, then moved it or sent it to exchanges.

No exploit, but a fast fix

There's no evidence anyone actually used it, RippleX engineers say. Normal payments never came close to triggering the overflow, which is why it lurked unnoticed.

The patch shipped in version 3.4.1 on Sept. 25. More than 80% of trusted validators were running it that day. Usually changes need a two-week validator vote. This one bypassed that process for the first time in over a decade. Maintainers said severity justified it, because open-sourcing the fix early would have exposed the bug while still exploitable for weeks.

The takeaway: even battle-tested ledgers can hide nasty bugs for years, but the fast patch shows why bug bounties matter.