What could the XRP Ledger vulnerability have allowed attackers to do?

The flaw could have allowed attackers to create spendable XRP (CRYPTO:XRP) through payment calculations that produced incorrect results when processing certain transactions.

How did the XRP Ledger address the vulnerability?

The XRP Ledger released a software fix that added overflow checks to payment calculations and strengthened safeguards against creating unauthorised XRP (CRYPTO:XRP).

What versions of the XRP Ledger software were affected?

The vulnerability affected xrpld version 3.4.0 and earlier, while the fix was included in version 3.4.1, released on 25 September 2026.

What does the XRP Ledger vulnerability mean for XRP holders?

The vulnerability showed how a software flaw could threaten the integrity of XRP (CRYPTO:XRP) supply, but developers reported no evidence that attackers had exploited it on public networks.

Cryptocurrency

Image for illustrative purposes only. Not a real photo.

XRP Ledger patches flaw that threatened XRP supply integrity

Q: Why did the XRP Ledger fix the payment-engine vulnerability?

The XRP Ledger fixed a payment-engine vulnerability that could have allowed attackers to create additional spendable XRP (CRYPTO:XRP) without making the required payment.

Written by Heidi Cuthbert Published Oct 12, 2026, 2:12 AM

The XRP Ledger released a software patch addressing a payment-engine flaw that could have created spendable XRP beyond the network’s intended supply.
The vulnerability affected xrpld version 3.4.0 and earlier, but developers found no evidence of exploitation on public networks.
The XRP Ledger also fixed a separate Batch transaction validation flaw before the feature activated on mainnet.

The XRP Ledger has fixed a payment-engine bug that could have allowed attackers to create additional spendable XRP without making the required payment.

The flaw affected xrpld version 3.4.0 and earlier, with the fix included in version 3.4.1, released on 25 September.

The vulnerability report said researchers found no evidence that the flaw had been exploited on any public network.

The bug involved integer overflow when payments consumed hundreds of specially priced offers in an order book, causing the calculated payment total to wrap around.

The patch adds overflow checks to payment calculations and uses a wider counter for the ledger’s safeguard against creating XRP.

The vulnerability reportedly dated back to 2015, while researchers discovered it through the XRPL Bug Bounty programme in September 2026.

The same release also addressed a separate Batch transaction validation flaw, which could have created consensus risks if left unfixed before activation.

Following the update, XRP was trading up 0.4% at $1.40.