XRP Ledger discloses a critical decade-old overflow bug that could mint XRP beyond the fixed supply; report credits Cayden Liao and Veria AI
Partly confirmed
The takeaway
On Oct 9, 2026 the XRP Ledger’s maintainers disclosed a critical integer-overflow bug in the payment engine, believed to date from 2015, that could create spendable XRP beyond the fixed 100-billion supply in a single validated transaction.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 2 of 5
- Last verified
- 12 October 2026
Your AI and this story
- GPT-6 Astra162 days after its cutoff
- Claude Opus 5.5101 days after its cutoff
- Gemini 3.8 Flash192 days after its cutoff
- Grok 4.7131 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 101 days before it.
Key facts
- Disclosure: XRPL vulnerability report published Oct 9, 2026; acknowledgements credit ‘Cayden Liao and Veria AI’ for the original report and proof of concept, submitted through the XRPL bug bounty programme
- Bug: unchecked 64-bit addition when the payment engine sums offer amounts; the ‘no XRP created’ invariant used the same arithmetic and so missed it. Affects xrpld 3.4.0 and earlier; the flaw is believed to date to 2015 (CoinDesk)
- Attack (CoinDesk): open hundreds of accounts, each offering a little of a token for a large amount of XRP, then send one payment that fills all offers; the total overflows, sellers are paid in full and the buyer is charged almost nothing. Cost: a few hundred XRP in account reserves plus fees
- Severity: rated Major by the reporter, raised to critical by RippleX Engineering after it reproduced the attack on a standalone server and spent the newly created XRP
- Timeline: reported and confirmed Sept 22; fix merged Sept 23; xrpld 3.4.1 released Sept 25 without saying what it repaired (over 80% of default-UNL validators upgraded that day); public report Oct 9
- The fix shipped without the amendment vote, which the report calls the first deliberate change to transaction processing shipped that way since amendments were introduced
- ‘No evidence the flaw was exploited on any public network’ (RippleX, per CoinDesk)
- AI role: not described. Neither the XRPL report nor CoinDesk names a model or explains Veria AI’s part; the report says XRPL’s own defences include ‘AI-assisted red teaming’. CoinDesk notes other crypto flaws surfaced with AI help since July (Coldcard firmware, Core Lightning)
Show 1 more
- Earlier: in Feb 2026 an autonomous AI audit tool (Cantina’s Apex, with researcher Pranamya Keshkamat) found a signature-validation flaw in XRPL’s pending Batch amendment before activation (per press reports; not checked against a primary source)
What happened
The XRP Ledger has had a fixed supply of 100 billion XRP since 2012. A researcher working with a firm called Veria AI found that one carefully built payment across hundreds of accounts could overflow the ledger’s arithmetic and pay out XRP that nobody had funded, and that the safety check meant to catch exactly this used the same faulty sum. Ripple’s engineers confirmed it within a day, shipped a fix three days later without explanation, and published the details on Oct 9 once most validators had upgraded.
Why it matters
It is one more case in the 2026 pattern of old, severe bugs in financial infrastructure surfacing quickly, often with AI tools on the finder’s side. It came out in the same week as Justin Drake’s “bunker mode” warning about AI and cryptography, which is a different risk (breaking the maths, not finding code bugs).
Uncertain: how much of the discovery was done by an AI system. Headlines such as “AI uncovers XRP Ledger bug” (AOL) go beyond what the primary report states.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 press
Primary
- XRPL: Vulnerability disclosure report (Oct 9, 2026)xrpl.org, official
Press
Changes
- Filed (XRPL report and CoinDesk read directly)