A security flaw in the XRP Ledger payment software, present since 2015, could have allowed the unauthorized creation of XRP tokens. The vulnerability involved an integer overflow in the payment engine, which could have enabled attackers to acquire large amounts of XRP while paying negligible costs.
Researchers Cayden Liao and Veria AI identified the issue and reported it through the XRPL bug bounty program on September 22, 2026. RippleX released a patch in server software version 3.4.1 on September 25, 2026, to address the vulnerability, which affected version 3.4.0 and earlier.
Unlike standard procedures requiring an 80% validator vote over two weeks, this update was implemented immediately upon operator upgrade. RippleX stated this bypass was necessary to prevent public exposure of the exploitable code during the voting period. Over 80% of default validators updated their software on the release day.
