The XRP Ledger bug disclosed in October 2026 was a critical payment-engine vulnerability. It could theoretically create spendable XRP beyond the network's intended 100 billion supply.
The issue was found through the XRPL bug-bounty program. It was fixed before the technical details appeared in the official XRPL vulnerability report.
No, 18 trillion XRP was not added to circulation. That number came from a security researcher's controlled test.
XRPL's official disclosure says there is no evidence of an exploit on any public network. The supply structure described in Tapbit's guide to how many XRP exist did not suddenly change.
What Exactly Was the XRP Ledger Bug?
The flaw was an integer overflow in the payment engine. This part of the system adds together amounts from multiple offers.
Computers store numbers within fixed limits. When unchecked arithmetic passes that limit, the result can wrap around to a much smaller number instead of producing an error.
In this case, an attacker could create hundreds of accounts. Each account would place an unusual offer: sell a tiny amount of another token in exchange for an enormous amount of XRP. The attacker would then submit one payment designed to consume all those offers.
The engine would credit each offer owner with the full XRP amount requested. But the combined buyer total could overflow and wrap around.
The buyer might then be charged only a few hundred drops—the smallest unit of XRP—plus the normal transaction fee.
| Stage | What the Vulnerable Engine Could Do |
|---|---|
| Offer creation | Accept individually valid offers asking for extremely large XRP amounts. |
| One combined payment | Consume hundreds of those offers in a single transaction. |
| Total calculation | Overflow the fixed-size integer and wrap the buyer's charge to a small value. |
| Seller credits | Pay each attacker-controlled seller the full amount recorded in its offer. |
| Result | Create XRP that the buyer never actually supplied. |
Why Did the XRP Supply Safety Check Not Stop It?
The XRP Ledger already had an invariant intended to reject any transaction that creates new XRP. An invariant is a rule that should remain true after every valid transaction. Here, the rule compared balance changes across the transaction to confirm that XRP was not appearing from nowhere.
The problem was that this check added the balance changes using similar fixed-size arithmetic. It could wrap around in the same way as the payment calculation. The net change then looked like an ordinary transaction fee rather than a huge increase in supply.
A second check limited the balance of an individual account. The proposed exploit avoided that control by spreading the newly created XRP across hundreds of attacker-controlled accounts. Each account remained below the individual limit even though the combined amount was far above the network's total supply.
Where Did the 18 Trillion XRP Number Come From?
Veria Labs co-founder Cayden Liao said the firm's AI security agent found the issue and built a working exploit. He estimated that one constructed transaction could create about 18 trillion XRP.
That equals roughly 184 times the original 100 billion supply. The estimate and bounty details appeared in The Block's review of the disclosure.
That figure describes theoretical exploit capacity, not an observed mainnet event. The distinction matters for both readers and search engines:
- Original XRP supply: 100 billion XRP were created when the ledger launched.
- Test estimate: about 18 trillion XRP could be generated by one modeled exploit transaction.
- Confirmed public-network creation: none found by XRPL developers.
The flaw required intentionally abnormal offers and a transaction engineered to consume them together. It could not be triggered by a normal XRP payment or an ordinary trade.
Was the XRP Ledger Actually Exploited?
XRPL's official vulnerability disclosure says the team found no evidence that the issue was exploited on any public network. The researcher reported the payment-engine problem on September 22. RippleX reproduced it in a local standalone server and the unit-test framework, then raised its severity to critical.
The fix shipped in xrpld 3.4.1 on September 25. The public disclosure followed on October 9, after a large majority of trusted validators were running the corrected software.
How Did XRPL Fix the Overflow?
The updated payment engine now checks whether adding offer amounts would exceed the allowed range. If an overflow would occur, that part of the payment fails normally instead of wrapping around. Nothing is minted.
Developers also strengthened the invariant that checks whether XRP was created. It now uses a wider counter that cannot overflow in the same way. Similar balance-aggregation code was hardened as a precaution.
Why Was the Fix Shipped Without the Normal Amendment Vote?
XRPL rule changes usually follow an amendment process. A change activates only after more than 80% of trusted validators support it continuously for two weeks. That approach keeps all servers synchronized when transaction rules change.
The overflow patch was different. If the source code had been published through the normal process before activation, an attacker could examine it, reconstruct the vulnerability, and target servers that had not upgraded. Developers therefore distributed corrected binaries before publishing the source and full disclosure.
The choice created a transparency debate because the corrected binaries appeared before the full source and disclosure. RippleX engineers said immediate publication could have helped attackers target servers that had not upgraded.
What Does the Bug Mean for XRP Traders?
The direct supply shock did not occur, so the story is not equivalent to a real 18-trillion-token inflation event. Its market relevance comes from four other factors:
- Security confidence: a decade-old critical bug can affect how traders price technical risk.
- Response quality: fast reporting and validator upgrades can rebuild confidence.
- Headline volatility: “18 trillion XRP” can move sentiment even though the amount was never minted.
At the October 12 data check, XRP traded near $1.41 with an intraday range of about $1.39 to $1.42. Those prices are time-sensitive and should be refreshed immediately before publication.
RippleX handled the software fix, but Ripple, XRP and XRPL are different things. Tapbit's Ripple vs. XRP guide explains the distinction.
How to Trade XRP on Tapbit
- Create or log in to a Tapbit account and prepare USDT. Use the Tapbit registration page, complete the required account steps, and fund the futures balance.
- Open the XRP-USDT perpetual market. Go to the Tapbit XRP-USDT futures page, confirm the contract ticker, then select isolated or cross margin and choose a leverage level that matches the position plan.
- Choose direction and order settings. Select long or short, use a limit or market order, enter position size, and set stop-loss and take-profit levels.
- Review and manage the trade. Check entry price, margin, estimated fees and liquidation price before submitting. Monitor the open position and close or reduce it if the original condition changes.
FAQ
Did someone mint 18 trillion XRP?
No. About 18 trillion XRP was a research estimate for a controlled exploit. XRPL developers found no evidence that the bug was used on a public network.
Could the XRP Ledger bug create real, spendable XRP?
Yes, before the fix a deliberately constructed transaction could theoretically create XRP that could then be transferred or traded.
When was the XRP bug fixed?
The fix shipped in xrpld 3.4.1 on September 25, 2026. The official vulnerability report was published on October 9.
Was XRP's 100 billion supply permanently changed?
No. There is no evidence of a successful public-network exploit, so the theoretical 18-trillion figure did not become circulating supply.
Who found the XRP Ledger vulnerability?
The issue was reported through the XRPL bug-bounty program. Veria Labs said an AI security agent helped discover and reproduce the payment-engine flaw.
Is XRP-USDT available on Tapbit?
Yes. Tapbit lists an XRP-USDT perpetual futures market. A perpetual contract provides price exposure and does not mean the trader owns XRP in a personal wallet.
