XRP Ledger Foundation Clarifies Supply Bug Patch as Bounty Debate Erupts
The XRP Ledger Foundation said a critical flaw could have bypassed the ledger's fixed-supply rules, but no extra XRP was created and the total supply remains capped at 100 billion. The issue was patched in version 3.4.1 and later formalized through an amendment vote requiring over 80% validator support for two weeks. On-chain investigator ZachXBT criticized the size of the reward paid to researchers Cayden Liao and Veria AI for the disclosure.
The XRP Ledger's supply has been capped at 100 billion since launch, and no transaction can mint more; roughly 99.986 billion remain after fee burns. The flaw offered a workaround, but reaching it required hundreds of carefully constructed operations rather than ordinary payments.
Because a public amendment process would have given attackers weeks of warning, the Foundation, RippleX, core developers and validators coordinated a direct patch. Binaries shipped September 25, 2026, the same day default UNL validators received the fix; an amendment vote later demanded over 80% validator support for two weeks. Researchers Cayden Liao and Veria AI were credited.
Holders and institutions relying on XRP's fixed-supply promise may take some reassurance that the cap held and the fix is live, though the bounty dispute could influence how future researchers weigh disclosure against exploitation. If whitehat rewards are perceived as small relative to the risk, some security specialists might report flaws less readily, potentially leaving vulnerabilities exposed longer. The episode may also prompt other blockchain projects to revisit payout scales and formal verification practices.