The foundation behind the XRP Ledger has defended an emergency software patch that closed a critical bug capable of creating new XRP out of thin air — the first time in more than a decade the network changed its transaction rules without the usual validator vote.
The flaw, believed to date back to 2015, sat in the ledger’s built-in exchange. According to a security report published last week, an attacker could have opened hundreds of accounts, posted offers swapping tiny amounts of a token for outsized amounts of XRP, then bought every offer in a single payment. The total owed would have been too large for the software to count correctly — leaving the attacker with XRP that had never existed. The researcher who found it, working with a security firm, reported it privately on 22 September; the fix shipped three days later. The disclosure adds to a turbulent stretch for technology markets, days after TSMC posted a record $46.7 billion quarter on surging AI chip demand.
“No XRP was created”
In a statement this week, the XRP Ledger Foundation moved to quash rumours that the bug had been exploited. The total XRP supply was fixed at 100 billion when the ledger launched, it said, and no transaction is permitted to create more; the bug was a way around that rule, closed in version 3.4.1 about two weeks ago. Because all ledger data is public, any new XRP would be visible in account balances — and none has been found. Roughly 99.986 billion XRP exist today, the supply slowly shrinking as transaction fees are destroyed.
The foundation said ordinary payments could never have triggered the flaw — it took hundreds of deliberately constructed operations — and that artificial intelligence is making such bugs faster to find, for attackers and defenders alike. It promised stronger formal verification, adversarial testing and an expanded bug bounty programme.
The decentralisation question
The episode has reignited debate about how decentralised the network really is. The fix shipped as compiled software before its source code was public, and it bypassed the standard amendment process — under which changes normally require more than 80 per cent of validators to vote in favour over two weeks — precisely because a public vote would have advertised the vulnerability to attackers.
The foundation says the decision was a joint one by the foundation, developers and validators acting in social consensus, and notes that version 3.4.1 only became mandatory through the normal amendment vote afterwards. Critics are unconvinced, with one fund manager calling the network’s decentralisation claims overstated. The line between emergency stewardship and centralised control, it seems, is drawn one patch at a time. The foundation’s full clarification was covered in crypto trade press.
