AI · CoinDesk
RippleX said it found no evidence the flaw was exploited on any public network
Compiled by KHAO Editorial — aggregated from 2 sources. See llms.txt for citation guidance.
✓ KHAO Verified
All 100 billion XRP were created when the ledger launched in 2012, and its software is built so no more can ever be added.
Key facts
- Developers shipped the fix in xrpld 3.4.1, the ledger’s server software, on Sept. 25 without disclosing what it repaired
- The bug, believed to date to 2015, was found by researcher Cayden Liao and Veria AI and internally reported on Sept. 22
- All 100 billion XRP were created when the ledger launched in 2012, and its software is built so no more can ever be added
- The incident joins a run of long-hidden crypto security flaws surfaced with AI help since July, including the Coldcard wallet bug behind the theft of at least 1,367 BTC and the vulnerabilities
Summary
A flaw dating to 2015 could have allowed attackers to create and spend new XRP, violating the cryptocurrency’s fixed supply of 100 billion tokens. The vulnerability exploited a counting error in the XRP Ledger’s built-in exchange, allowing hundreds of accounts to receive large amounts of XRP while the buyer paid almost nothing. RippleX said it found no evidence of exploitation on public networks and fixed the flaw in the xrpld 3.4.1 software release on Sept. 25. A flaw in the XRP Ledger’s payment system could have let an attacker create large amounts of new XRP without paying for it, breaking the token’s fixed-supply rule, according to a security report published Friday. The bug, believed to date to 2015, was found by researcher Cayden Liao and Veria AI and internally reported on Sept. 22.