Why a bug that could have threatened XRP's 100 billion supply cap stayed hidden for years
Reported by CoinDesk · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
A bug in the XRP Ledger, hidden for over a decade, could have allowed attackers to mint billions of XRP, breaking the cryptocurrency’s 100 billion supply cap. The flaw, an integer overflow, was discovered by researcher Cayden Liao and Veria AI and reported on September 22, 2026. RippleX promptly patched the vulnerability after finding no evidence of its exploitation or unauthorized XRP creation.
Why it matters
The bug threatened the foundational rule that the XRP supply can never exceed 100 billion tokens, which underpins trust in the cryptocurrency. The source emphasizes that no damage occurred but notes that understanding such vulnerabilities is crucial for maintaining blockchain security, especially as AI tools increase the speed at which flaws can be found.
Key context
The XRP Ledger is a decentralized, open-source layer-1 blockchain launched in 2012 with a fixed supply of 100 billion XRP tokens. The bug likely existed since 2015 and involved an integer overflow that reset transaction sizes exceeding a limit to near zero, allowing manipulated transactions to credit sellers fully while buyers paid almost nothing. This flaw required hundreds of deliberately crafted transactions to exploit and thus went unnoticed during normal use.
Key numbers and entities
RippleX and the XRP Ledger Foundation are responsible for the patch and explanation. Researcher Cayden Liao and Veria AI discovered the bug. It was present since about 2015, reported on September 22, 2026, and the circulating XRP supply remains about 99.986 billion.
What remains unclear
The source does not detail the exact technical fixes applied to resolve the bug or describe any long-term measures beyond plans for AI adversarial testing and an improved bug bounty program. It also does not specify whether future audits will include retrospective checks for any subtle exploitation that might have occurred unnoticed.