#xrp账本修复可增发xrp的漏洞
A single specially crafted transaction could create 18 trillion XRP out of thin air—180 times its total supply cap 🦖
📣 盘面异动群里喊
The XRP Ledger team has just fixed an integer overflow vulnerability hidden in its payment engine. Security researcher Cayden Liao used a proof of concept to show that a specially crafted transaction could generate 18 trillion XRP out of thin air.
Since launching in 2012, the ledger has claimed a hard cap of 100 billion tokens. XRP can’t be mined or staked, so 18 trillion would be equivalent to multiplying the total supply by 180 out of nowhere.
Even more chilling is how long the vulnerability went unnoticed: it had been sitting in the code for over a decade, and wasn’t reported through the XRP Ledger bug bounty program until September 22, 2026.
The development team skipped the usual two-week validator amendment process and pushed an emergency patch within three days, upgrading the xrpld node software to version 3.4.1. More than 80% of default validators completed the upgrade that day.
The team waited until it had confirmed the network was secure and the attack window was completely closed before publicly disclosing the details on October 9. Liao’s team received the top-tier bounty of $250,000, and the incident was officially described as an exceptionally significant security discovery ⚠️
One detail really matters: this attack required combining two vulnerabilities that had each been rated low risk. Neither was fatal on its own, but together they could blow right through the fixed supply cap.
Here’s my take: XRP’s biggest selling point has never been speed, but its fixed supply of 100 billion tokens. That number underpins the entire valuation framework institutions have built around it. If the supply can be duplicated, trust will collapse before the price does.
What this incident really exposed wasn’t the coding standards of one particular ledger, but a much broader problem: the longer legacy code runs, the more likely it is to accumulate obscure corners that nobody checks anymore. This time it was an overflow; next time, it could be something else 💥
Fortunately, nobody actually created any tokens this time, and there were no on-chain fund losses. The XRPL Foundation has awarded more than $1 million in bounties over the years, and this one was among the most expensive—and most worthwhile.
Two things are worth watching next: first, whether other long-running ledgers have similar overflow logic; and second, whether this news causes a flight-to-safety move in the price of XRP.
Do you think vulnerabilities that allow tokens to be created out of thin air are an inevitable part of blockchain, or just rare occurrences? Let’s talk in the comments 🦕
Every day, I bring you the latest crypto market trends—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀
A single specially crafted transaction could create 18 trillion XRP out of thin air—180 times its total supply cap 🦖
📣 盘面异动群里喊
The XRP Ledger team has just fixed an integer overflow vulnerability hidden in its payment engine. Security researcher Cayden Liao used a proof of concept to show that a specially crafted transaction could generate 18 trillion XRP out of thin air.
Since launching in 2012, the ledger has claimed a hard cap of 100 billion tokens. XRP can’t be mined or staked, so 18 trillion would be equivalent to multiplying the total supply by 180 out of nowhere.
Even more chilling is how long the vulnerability went unnoticed: it had been sitting in the code for over a decade, and wasn’t reported through the XRP Ledger bug bounty program until September 22, 2026.
The development team skipped the usual two-week validator amendment process and pushed an emergency patch within three days, upgrading the xrpld node software to version 3.4.1. More than 80% of default validators completed the upgrade that day.
The team waited until it had confirmed the network was secure and the attack window was completely closed before publicly disclosing the details on October 9. Liao’s team received the top-tier bounty of $250,000, and the incident was officially described as an exceptionally significant security discovery ⚠️
One detail really matters: this attack required combining two vulnerabilities that had each been rated low risk. Neither was fatal on its own, but together they could blow right through the fixed supply cap.
Here’s my take: XRP’s biggest selling point has never been speed, but its fixed supply of 100 billion tokens. That number underpins the entire valuation framework institutions have built around it. If the supply can be duplicated, trust will collapse before the price does.
What this incident really exposed wasn’t the coding standards of one particular ledger, but a much broader problem: the longer legacy code runs, the more likely it is to accumulate obscure corners that nobody checks anymore. This time it was an overflow; next time, it could be something else 💥
Fortunately, nobody actually created any tokens this time, and there were no on-chain fund losses. The XRPL Foundation has awarded more than $1 million in bounties over the years, and this one was among the most expensive—and most worthwhile.
Two things are worth watching next: first, whether other long-running ledgers have similar overflow logic; and second, whether this news causes a flight-to-safety move in the price of XRP.
Do you think vulnerabilities that allow tokens to be created out of thin air are an inevitable part of blockchain, or just rare occurrences? Let’s talk in the comments 🦕
Every day, I bring you the latest crypto market trends—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀