The XRP Ledger team has disclosed a critical arithmetic flaw in xrpld versions 3.4.0 and earlier. The bug, which likely existed since 2015, could have allowed for the creation of XRP tokens beyond the network's 100 billion limit by exploiting a 64-bit integer overflow during payment processing.
Researcher Cayden Liao reported the vulnerability on September 22, 2026, via the XRPL Bug Bounty program. RippleX confirmed the issue by reproducing the attack on a standalone server, demonstrating that inflated balances could be spent in subsequent transactions.
An emergency patch, version 3.4.1, was released on September 25, 2026. The update bypassed the standard validator voting process to ensure immediate deployment. Public disclosure of the vulnerability followed on October 9, 2026.
Investigators found no evidence that the exploit was ever used on the public network. No loss of funds or consensus issues were reported. Node operators are urged to upgrade to version 3.4.1 to secure their systems against the documented flaw.
