A Decade-Old Bug That Could Have Minted Unlimited XRP: Is the 100 Billion Cap Safe Now?

A flaw hiding in the XRP Ledger since 2015 could have let an attacker conjure spendable XRP out of nothing, bypassing the 100 billion coin cap entirely. What it took to trigger it, and whether any extra coins were ever…

This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.

A vulnerability in the XRP Ledger’s payment processing system could have allowed an attacker to create new, spendable XRP (CRYPTO: XRP) out of thin air, potentially violating the XRP supply cap of 100 billion coins. This flaw, present since 2015, went unnoticed for nearly ten years, according to a vulnerability disclosure report published by RippleX, the development arm of Ripple, on October 9, 2026.

Fortunately, the report reassures users that no evidence shows anyone exploited this vulnerability on the public network. Researchers Cayden Liao and Veria AI reported the bug on September 22 through the XRP Ledger’s bug bounty program, and RippleX released the fix just three days later, on September 25—two weeks before the information was made public.

As of October 10, XRP trades around $1.40, reflecting the same range it was in shortly after the 2024 election. On the day the report was released, XRP opened at $1.38 and closed at $1.39, suggesting traders reacted minimally. However, if a long-standing bug could have created new XRP, can holders trust the supply is accurate?