XRP Ledger discloses patched decade-old payment-engine overflow; no exploitation found
09 Oct 2026 disclosure (fix shipped 25 Sep): researcher Cayden Liao and Veria Labs reported through XRPL's bug bounty a counting flaw from about 2015 in how the ledger's built-in exchange sums trades.
In principle it could have minted spendable XRP beyond the fixed supply, and a safety check used the same faulty arithmetic. 1 on 25 Sep; most default-UNL validators upgraded the same day. A related amendment went live on Mainnet on 09 Oct.
RippleX found no evidence of exploitation on a public network. Veria says it received the maximum $250K bounty. Research snapshot from the XRPL Foundation disclosure, CoinDesk, and Veria Labs.
369 take
This is a responsible-disclosure near-miss, not a loss event. Quiet patch before public write-up, validators upgraded, bounty paid.
Contrast with cases where a fix sat in a public repo but never reached production.
Old ledger math can still hide critical bugs; AI-assisted research is speeding that hunt for good actors and attackers alike.
Sources