XRP Ledger Defends Emergency Patch for Unlimited XRP Bug

The XRP Ledger defended an emergency security patch that closed a vulnerability capable of creating spendable XRP beyond the network’s fixed supply, saying the normal upgrade process would have left the flaw exposed for weeks.

The patch, released Sept. 25, addressed an integer overflow in the payment engine. An attacker could have created hundreds of specially priced offers and used one payment to consume them, causing the system to credit large XRP amounts while charging only a much smaller wrapped total.

The flaw had existed since 2015 and required a deliberately constructed attack; ordinary trading could not trigger it. Developers found no evidence that it had been exploited on a public network.

The update took effect immediately on servers that installed it, bypassing the XRP Ledger’s normal amendment process. Under that process, protocol changes typically require more than 80% validator support for two weeks before activation. The emergency release was the first deliberate bypass of that system since it was introduced more than 10 years ago.

The XRP Ledger Foundation said the decision followed a joint assessment by the Foundation, RippleX, core developers and validators. It rejected claims that coordinated upgrades showed a single party controlled the network, saying independent operators could coordinate while retaining the choice of which software to run.