XRPL Closes 2015 Overflow Flaw: What XRP Holders Face

The XRP Ledger disclosed a bug on 9 October 2026 that had been sitting in the chain's payment engine for about eleven years. Anyone exploiting it could have created XRP far beyond the total supply in a single valid transaction. The flaw has been closed since 25 September with version xrpld 3.4.1, and RippleX writes in its report that there is no indication anyone used it on a public network.

So this is not a warning about an attack in progress. What is left to settle is your own setup: where your coins sit, who runs the server behind them, and which version is running there. This article places the disclosure report in context, explains the arithmetic error in plain terms, and translates it into the points an investor in Europe can check without outside help.

Payment engine overflow: what the 9 October report discloses

The disclosure report for xrpld 3.4.1 describes two separate findings. The more serious one concerns the payment engine, the part of the software that routes a payment through the offers in the chain's order book and works out how much the payer must give up and the recipient must receive.

The finding was submitted on 22 September 2026 through the XRP Ledger bug bounty programme, the channel where security researchers hand in vulnerabilities for a reward. The report names Cayden Liao and Veria AI as the finders. It was initially rated "Major". After RippleX reproduced it, the team raised the rating to critical.