- Researchers discovered a critical vulnerability in the XRP Ledger that could have allowed an attacker to generate new XRP out of thin air using coordinated transactions across hundreds of accounts.
- Ledger core developers silently patched the issue on September 25 with the release of server software version xrpld 3.4.1 without disclosing the specifics of the exploit at the time.
- The vulnerability adds to an escalating sequence of long-standing crypto security flaws recently brought to light through artificial intelligence-assisted auditing.
Critical XRP Ledger Vulnerability Could Have Created Tokens Out of Thin Air
Security researchers identified a severe accounting vulnerability within the XRP Ledger (XRPL) that theoretically enabled bad actors to mint unbacked XRP tokens from nothing. The attack vector depended on setting up hundreds of unique ledger accounts, each configured to trade a tiny fraction of an arbitrary token in exchange for an abnormally large quantity of XRP. By executing a single sweeping payment transaction designed to satisfy all of those open offers simultaneously, an exploiter could trigger a catastrophic calculation error in the network’s underlying engine.
Because the aggregate XRP sum required to settle the simultaneous trades exceeded the capacity of the server software to count properly, the system would fail to tally the transaction accurately. Under this condition, the attacker’s selling accounts would receive their full XRP payouts, while the initiating buyer account was deducted virtually nothing. This mechanical miscalculation would effectively introduce completely new, unbacked XRP into the network supply.
Bypassing Ledger Checks and Security Limits
The flaw managed to evade the core defensive architecture designed to prevent fraudulent currency creation. While the XRP Ledger routinely executes an automated balance check after every transaction to confirm that no unauthorized XRP tokens have entered the ecosystem, that internal verification mechanism depended on the very same miscalculated total. Consequently, the safety check would fail to detect the newly generated balance.
Furthermore, built-in safety ceilings governing how much XRP an individual address can receive proved ineffective against the attack design. Because the researcher-devised method dispersed the incoming funds across hundreds of auxiliary accounts, no single address breached established limits. Executing the exploit required minimal operational capital: researchers noted that initiating the attack required merely a few hundred XRP to establish the accounts—the vast majority of which could be retrieved later—alongside minor network transaction fees.
Silent Deployment of the xrpld 3.4.1 Patch
XRPL core developers moved quickly to mitigate the risk prior to public disclosure. On September 25, the team deployed an update to the ledger’s primary server software, releasing version xrpld 3.4.1. The release shipped quietly, correcting the underlying accounting logic without publicizing the exact nature of the flaw or detailing that it prevented a token creation vulnerability.
Why This Matters: AI-Driven Audits and Crypto Security Infrastructure
The discovery of this XRPL loophole represents a critical moment in blockchain security, illustrating that fundamental math and balance-checking routines in major protocols can harbor latent vulnerabilities for extended periods. This flaw is part of a larger trend emerging since July, wherein artificial intelligence tools have increasingly assisted security teams in finding historical, hidden bugs across decentralized networks.
Similar AI-aided audits have recently unmasked several critical weaknesses across major infrastructure. These discoveries include the Coldcard hardware wallet bug linked to the loss of at least 1,367 BTC, as well as critical vulnerabilities within Core Lightning that led developers to advise Bitcoin node operators to sever their connections to protect the network. As automated discovery tools mature, protocol maintainers face heightened urgency to inspect core codebases before malicious actors can exploit overlooked mathematical flaws.
Frequently Asked Questions
How did the proposed exploit generate XRP out of thin air?
An attacker could create hundreds of accounts offering small token fractions for huge XRP amounts, then fulfill all offers in a single payment. The combined transaction total was too large for the software to register properly, causing the system to credit the seller accounts fully while barely charging the buyer account, effectively printing unbacked XRP.
Was any XRP stolen or created using this method?
The technique was uncovered by security researchers, and developers remediated the issue via the xrpld 3.4.1 release on September 25 before any known public exploitation occurred.
Why did the ledger’s post-transaction balance verification fail to flag the discrepancy?
The XRP Ledger runs automated balance audits after transactions, but that audit mechanism relied on the identical miscounted total produced by the payment calculation. In addition, account-level receiving limits were bypassed by spreading the payouts over hundreds of separate accounts.
