GoKawiilXRP Ledger bug that could mint 18 trillion XRP patched after researcher disclosure
A vulnerability in the XRP Ledger's payment engine, present for roughly eleven years, could have let an attacker mint about 18 trillion XRP in one transaction by exploiting an integer overflow in balance tracking, according to researcher Cayden Liao and security firm Veria Labs. The XRP Ledger Foundation disclosed the bug on October 9, three days after it was reported through the bug bounty program, and the fix had already shipped on September 25 in xrpld 3.4.1. Developers said they found no evidence the flaw was ever exploited on a live network.
GoKawiil's interpretation of the reporting above, not reported fact.
The bug bypassed two separate safeguards meant to catch unauthorized token creation, suggesting that layered security checks can still share a common blind spot if they rely on the same underlying miscalculation. RippleX engineers reportedly reproduced the exploit and confirmed the fraudulently created tokens could be spent, which indicates the flaw was not merely theoretical. The episode may renew scrutiny of how blockchain foundations handle legacy code audits and bug bounty response times.
- The flaw allowed a 64-bit integer overflow to reset huge balances to near-zero while still crediting sellers in full.
- The exploit required deliberately unrealistic order book setups, meaning it couldn't have been triggered accidentally.
- No evidence suggests the bug was exploited before the fix shipped on September 25, 2024, in xrpld 3.4.1.
Source: techreport.com — Krishi Chowdhary, 2026-10-14
Published there as: “How the XRP Ledger overflow bug could have minted 18 trillion XRP”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.