The XRP Ledger Broke Its Own Rules to Kill an 18 Trillion XRP Bug

The XRP Ledger skipped its own governance process to kill a bug that could have created XRP out of nothing. The fix worked, but it handed critics a fresh argument about how decentralized the network really is.

A patch that shipped without a vote

The update landed on September 25, three days after a bug bounty report, and took effect on any server that installed it. Protocol changes normally ship dormant and only activate after more than 80% of trusted validators back them for two weeks.

Developers call it the first deliberate bypass of the amendment process in the ledger's history. A normal vote would have left the fix public for weeks while the bug stayed live.

What the bug could do

The flaw was an integer overflow in the payment engine that had been sitting there since 2015. XRP balances are stored as 64-bit integers, so when a sum blew past that ceiling it wrapped to a small number instead of failing.

Triggering it took hundreds of specially priced offers and one payment built to consume them all at once. The engine paid every offer owner in full but charged the buyer only the wrapped total — and the difference became spendable, newly minted XRP.

A security firm's AI agent found the flaw while combing through the ledger's code, by chaining two bugs that were low severity on their own. Its co-founder estimates one exploit transaction could have produced about 18 trillion XRP, 184 times the token's supply.

The bounty paid out was $250,000. The foundation insists no XRP was created and that supply was capped at 100 billion at launch.

"Straight-up fraud"

Cyber Capital founder Justin Bons called selling XRP to retail as decentralized "straight-up fraud." He points to the emergency release shipping as binaries only, with source code withheld and operators pressured to upgrade.

The XRP Ledger Foundation rejected that framing, saying the call was made jointly by the foundation, RippleX, core developers and validators. An independent validator operator agreed, arguing that coordination is not the same as control.

Why it matters if you hold XRP

Developers say they found no evidence the bug was ever exploited on any public network. The uncomfortable part is the mechanism, not the patch.

A network willing to skip its own vote in three days can skip it again, which turns "fully decentralized" into something you audit rather than assume.