An integer overflow bug present in the XRP Ledger since 2015 allowed a single transaction to mint over 18 trillion XRP. That figure is equivalent to 184 times the coin’s current total supply.
Audit firm Veria Labs discovered the vulnerability using AI agents to comb through the rippled codebase, chaining two low-risk bugs into a major exploit. Veria Labs received a $250,000 bug bounty - despite mitigating a potential risk of $94 billion, equivalent to XRP’s entire market capitalization. There is no evidence the flaw was ever exploited on the public network.
However, developers’ moves to close this code vulnerability have sparked intense debate over who controls the network.
First Bypass in Ten Years
Veria Labs reported the findings on September 22. Three days later, on September 25, RippleX released an emergency fix without going through the standard two-week amendment process. This marks the first emergency patch to bypass standard upgrade procedures in the XRP Ledger’s more than ten-year history.
Criticism mounted because RippleX released the patch solely as a binary, while temporarily withholding the source code. Justin Bons, founder of Cyber Capital, leveled sharp criticism, calling the promotion of XRP as a decentralized asset to retail investors ‘straight-up fraud’.
Why Does the Final Decision Still Rest With Validators?
Responding to the scrutiny, the XRP Ledger Foundation emphasized that the emergency measure was not a unilateral decision. The binary release policy was mutually agreed upon by the Foundation, RippleX, core developers, and validators.
The update, designated Patch 3.4.1, is also not immediately permanently binding. The new rule still requires a standard amendment vote, demanding support from more than 80% of active validators for two full weeks.
Independent validator operator XRP Kuwait also defended the technical team’s actions. According to him, emergency coordination to patch a fatal risk is not evidence that the network is under centralized control.
Hardware Threat Spreads to Europe
Beyond the XRP Ledger code debate, physical security risks are threatening users through the circulation of modified Ledger hardware wallets. An X user named Johannes revealed that a Ledger unit purchased from a European MediaMarkt store two weeks ago contained a Eurasia-version implant, although no funds have been stolen yet.
In Asia, cybersecurity outlet Yfarmx estimated losses from counterfeit Ledgers reached $93.4 million across 471 wallet addresses. Official Ledger representatives have not yet confirmed the estimated loss figure.
For asset holders, these two events highlight risks on two fronts: a single code flaw can threaten billions of dollars in market cap, while retail store packaging seals still do not guarantee a device’s physical security.
Reported via Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
