XRP Ledger Details Critical Flaw That Could Have Minted Spendable XRP

The XRP Ledger (XRPL) published a security report on Oct. 9, 2026, describing two software vulnerabilities, including a critical issue that could have enabled an attacker to create new, spendable XRP. A separate flaw tied to the network's Batch transaction functionality carried the risk of disrupting transaction validation. XRPL said the critical payment-engine bug was patched in xrpld version 3.4.1, released Sept. 25. The project reported no evidence the issue was exploited on any public network. Payment engine overflow could have resulted in new XRP The critical vulnerability centered on how the payment engine calculated the XRP needed to execute trades across multiple offers in an order book. Under certain conditions, the computation could overflow when the combined amount exceeded the system's maximum supported value. In that scenario, the engine could charge a buyer less XRP than the amount credited to offer owners, effectively creating XRP. XRPL said exploitation would have required a deliberately constructed order book containing hundreds of offers with unusually high prices, followed by a specific payment transaction. The bug could not be triggered through normal payments or typical trading activity. A researcher submitted the report via the XRPL Bug Bounty program on Sept. 22, 2026. RippleX engineers reproduced the issue and confirmed that any XRP created through the flaw could be spent. Version 3.4.1 added checks to prevent the overflow and strengthened safeguards designed to block unauthorized XRP creation. Batch transaction flaw raised consensus risk The second vulnerability involved XRPL's Batch transaction feature, which lets users submit multiple transactions together. The report said a transaction within a batch could include an improperly structured field and still be accepted and processed by a server. That behavior introduced the possibility that different XRPL software versions could disagree on a transaction's validity. Such divergence could prevent validators from reaching consensus and disrupt ledger validation. XRPL said the issue did not allow signature bypasses or direct theft of funds. The project addressed the Batch issue through the fixBatchV1_2 amendment, which requires the correct transaction structure. XRPL noted that the Batch feature had not been activated on mainnet when the vulnerability was identified, and the report did not point to any mainnet accounts or funds affected. Mainnet activates Batch security fix; testing process updated Developers and validator operators withdrew support for the original Batch amendment to reset its activation timeline while preparing the fix. The corrected amendment reached the required support and activated on mainnet on Oct. 9, 2026, the same day the vulnerability report was released. XRPL also outlined a change to its security testing workflow, saying it plans to retest reported vulnerabilities against release candidates to confirm fixes function as intended ahead of software releases. What XRP holders should know XRPL said both issues have been addressed and it found no evidence the critical payment-engine bug was exploited on a public network. The report did not conclude that either vulnerability led to a loss of funds or an increase in XRP supply. The payment-engine fix is included in xrpld 3.4.1, while the Batch issue was resolved via the fixBatchV1_2 amendment. The report did not advise XRP holders to move funds or change private keys. The upgrade primarily applies to XRPL server operators, who must run compatible versions to stay synchronized with the network.