In this article5 sections
The XRP Ledger Foundation has confirmed that it bypassed the network’s standard amendment procedure to close a payment-engine bug that could have allowed roughly 18.45 trillion XRP to be produced in one transaction, according to U.today.
The foundation said the flaw, uncovered by AI-powered security firm Veria Labs, dated to 2015 and would have let an attacker break the ledger’s fixed supply cap. The figure of 18.45 trillion XRP is about 180 times the original XRP supply and would have put the network’s $94 billion market capitalization in jeopardy. The foundation stated that no unauthorized XRP was minted and that the exploit was never seen on the public network.
Also readXRP Ledger passes 13M x402 AI payments, RippleX says
Key facts
- Veria Labs identified a bug in the XRP Ledger payment engine that had been present since 2015 and could have yielded around 18.45 trillion XRP in a single transaction.
- The XRP Ledger Foundation confirmed the vulnerability could have bypassed the XRP fixed supply cap, and said the exploit was never observed on the public network.
- Validators received the patched software on Sept. 25, the same day public binaries were released.
- Standard XRP Ledger amendments require approval from more than 80% of trusted validators for two consecutive weeks before taking effect.
- The emergency response involved the XRP Ledger Foundation, RippleX, core developers and validators.
Why the foundation skipped the validator vote
Under normal conditions, any change to the XRP Ledger protocol is proposed as an amendment and must clear a threshold of over 80% of trusted validators held for two straight weeks. The foundation argued that running the fix through that process would have handed attackers a window of several weeks to weaponize the bug before the patch activated. It noted that vulnerabilities are easier to discover and reverse-engineer today, particularly with artificial intelligence tools, and that developers concluded an immediate software update was necessary.
No minting, and no forced upgrade
Addressing speculation about unauthorized XRP creation, the foundation pointed out that all XRP balances sit on public ledger data, so any newly minted tokens would be plainly visible. It added that network supply is watched continuously and that supply figures are verified by community members.
Also readGemini Enables Native XRP Ledger Transfers for Singapore Users
The foundation also rejected the idea that a single party could impose the update. It said no individual can compel network participants to adopt new software, even after a coordinated emergency release.
Why it matters
The incident tests a trade-off every decentralized network faces: open, slow governance versus fast response to an active threat. Because the patch skipped the amendment vote, the foundation is now defending its process as much as its technical fix, and its answer rests on public supply data that anyone can check. For holders, the practical change is that the supply cap held and the bug is closed; the open question is whether the precedent reshapes how the XRP Ledger handles the next emergency.
What to watch
Attention now turns to node operators and validators who received the patched software on Sept. 25 but are not obligated to run it. Their adoption rate, and whether the ledger’s supply data continues to match community verification, are the concrete signals to track.
Source: U.Today
