XRPL payment engine overflow could have minted XRP

What happened

On 9 October 2026 the XRP Ledger project published a vulnerability disclosure for xrpld 3.4.1 (also called rippled). One of the two bugs fixed in that release is a critical integer overflow in the payment engine. A researcher reported it through the XRPL bug bounty program on 22 September 2026.

XRPL says an attacker could have used specially crafted offers on the ledger's built-in exchange, then a single payment that consumed many of those offers at once. When the engine added up what the buyer owed, a large enough total wrapped around a 64-bit integer to a tiny value. Offer owners still received their full XRP amounts. The difference was new XRP that should never have existed, and it was spendable like ordinary XRP.

A separate safety check is supposed to reject any transaction that creates XRP. That check used the same kind of 64-bit summing, so it wrapped the same way and saw nothing wrong. XRPL rates the issue critical. RippleX engineers reproduced the mint on a local server, confirmed the new XRP could be spent in a follow-up payment, and raised the researcher's "Major" rating to critical.

XRPL's investigation suggests the overflow has been present since the current payment engine was written in 2015. The "no XRP created" check was added about two years later on the same unchecked arithmetic. The project says it found no evidence of exploitation on any public network.

Veria Labs, which submitted the report with Cayden Liao, published its own write-up. It says its AI agent found the two overflows, chained them, and built a working proof of concept on a local network. Liao then validated the proof of concept before the bounty submission. XRPL's disclosure credits "Cayden Liao and Veria AI" for the original report and proof of concept. It does not independently describe how much of the discovery was automated.

Who is affected

The overflow affected xrpld 3.4.0 and earlier, according to the disclosure. The fix is in 3.4.1, released as an emergency binary on 25 September 2026. Source code for that release was published with the 9 October disclosure.

Anyone who runs an XRP Ledger server or validator needed to upgrade. XRPL says more than 80 percent of validators on the default Unique Node List were already on 3.4.1 the day it shipped. The overflow fix took effect on each server as soon as it upgraded. It did not wait for the usual amendment vote. XRPL calls that the first deliberate bypass of the amendment process for a transaction-processing change in more than a decade.

A second, separate bug fixed in the same release (Batch inner-transaction wrapper validation) did use a new amendment, fixBatchV1_2, which became enabled on Mainnet on 9 October 2026. With that amendment live, servers that have not upgraded to 3.4.1 or newer are amendment blocked and cannot stay in sync.

Ordinary XRP holders and exchange users were not told to take account-level action. XRPL says no unauthorized XRP was created and no funds were lost. The attack path required a deliberate setup that normal payments and path finding would not hit by accident.

What is confirmed

These points are in XRPL's official disclosure or clearly attributed elsewhere:

• Critical payment-engine overflow that could mint spendable XRP beyond intended supply rules.
• Present since the 2015 payment-engine code (XRPL's assessment).
• Reported 22 September 2026; RippleX confirmed the same day; fix merged 23 September; xrpld 3.4.1 released 25 September.
• More than 80 percent of default UNL validators upgraded on release day.
• No evidence of public-network exploitation.
• Credit to Cayden Liao and Veria AI for the report and proof of concept.
• The overflow fix skipped the amendment process because of severity; XRPL Foundation, RippleX, and validators agreed on that path.

Veria Labs says it was awarded the XRPL bug bounty program's maximum $250,000 on 8 October 2026. The Block quotes Veria's Cayden Liao saying Ripple paid that top bounty. XRPL's published disclosure thanks Veria and Liao but does not state the dollar amount. ThreatWire treats the $250,000 figure as Veria's (and Liao's) claim about the program payout, not as a separately itemized Ripple press release.

Veria also says one successful trigger could have created about 18 trillion XRP in a single transaction, roughly 184 times the 100 billion genesis supply. XRPL's report says an attacker could have created "spendable XRP far beyond the total supply in a single validated transaction," without publishing that 18 trillion figure. The 18 trillion number is Veria's impact math (from wrapping a 64-bit drop counter), not XRPL's official total.

What is not confirmed

• A CVE or GitHub Security Advisory ID. ThreatWire found none tied to this disclosure as of writing.
• That the discovery was "entirely" autonomous. Veria's timeline includes human validation of the proof of concept by Liao before reporting. XRPL credits both Liao and Veria AI.
• Independent public confirmation of the $250,000 wire beyond Veria's statement and Liao's remarks to the press.
• Mainnet exploitation. XRPL says none was found.
• That everyday DEX trading could have hit the bug. XRPL says the required offers would sit below real liquidity, so normal payments would not reach them.

Veria linked a GitHub gist described as containing PoC files. That gist is not listed as a public gist in GitHub's API. ThreatWire did not treat it as a confirmed public PoC repository and does not set a PoC link on this article. ThreatWire did not run any proof of concept.

What to do

If you operate an XRP Ledger server or validator, run xrpld 3.4.1 or newer. Older servers are amendment blocked now that fixBatchV1_2 is enabled. Follow XRPL Operations guidance for the minimum required version.

If you only hold XRP or use a wallet or exchange, no action is required based on this disclosure. XRPL reports no minted XRP and no lost funds. Prefer software and services that keep their ledger software current.

Researchers should keep using the XRPL / Ripple bug bounty channels for further findings. RippleX's engineering leadership has said publicly that the team will expand AI-assisted bug hunting and formal verification after this incident.

Sources: XRPL vulnerability disclosure for xrpld 3.4.1 and the 3.4.1 release post, Veria Labs' write-up, The Block (11 October 2026), and Bitcoin.com News coverage of the same disclosure.