XRP Ledger's built-in exchange carried a decade-old bug that could mint XRP past its 100 billion cap

The check that runs after every transaction to confirm no new XRP has appeared used the same miscounted total as the payment, so it would have passed the bad trade ^[11]. The second guard, a limit on how much XRP any one account can receive, would not have fired either, because the attack spread the proceeds across hundreds of accounts ^[12].

The 100 billion figure is a property of the software. Every XRP was created at the 2012 launch, and the code is built so no more can be added ^[4]. CoinDesk reported that institutions using the network rely on that cap, and that an attacker could have sold the newly made XRP on exchanges ^[5]. Anyone valuing XRP on a fixed float is relying on that code. The flaw sat in it for about a decade ^[16]. Setting up the attack, by the researchers' method, took a few hundred XRP to open accounts, most of it recoverable, plus transaction fees ^[13].

In our view the likeliest outcome is that RippleX's finding of no exploitation on any public network holds, and this stays a patched bug with no supply consequence ^[2]. The attack leaves a distinctive footprint, hundreds of accounts posting lopsided offers that one payment clears at once ^[9], and RippleX says its search found no evidence of it ^[2]. The other outcomes are less comfortable. A reconciliation of ledger history could find a payment matching that pattern, and the supply figure would need restating. Or the kind of AI-assisted review that found this flaw could find a second one in the same exchange code. An independent count of balances that turned up XRP no funded payment explains would prove our view wrong.

RippleX went from internal report to shipped fix in three days ^[15]. A holder who only owns XRP has nothing to install. The version question belongs to whoever runs xrpld, and the patched release is 3.4.1 ^[3].

CoinDesk places the find in a run of long-hidden crypto flaws that AI tools have helped uncover since July, among them the Coldcard wallet bug that led to the theft of at least 1,367 BTC and the vulnerabilities that left Core Lightning telling operators of bitcoin nodes to disconnect ^[14].