XRP Ledger patched an unlimited-XRP bug that sat there since 2015

An integer overflow in the XRP Ledger payment engine could have created XRP beyond the network's fixed supply. A 64-bit value exceeded its maximum and wrapped to a smaller number instead of failing. The flaw had been in the code since 2015, and version 3.4.1 shipped on 25 September, three days after a bug bounty report.

“No single party could make that call alone. Every validator and node operator chooses what software to run”

— XRPL Foundation, Заявление о патче

Eleven years, then three days

A bug that threatens a fixed supply survived eleven years of review, and once someone reported it the fix took 72 hours.

Nobody has found evidence of exploitation on any public network. For a fixed-supply asset the XRP Ledger bug is the worst class of defect there is: an unlimited-mint path breaks the promise the whole supply rests on.

The team bypassed the process on purpose

The team released binaries first and held the source back for a while. That is ordinary embargo practice in security work, where publishing the diff tells an attacker where to look before every node operator has upgraded.

It was also the first deliberate bypass of the normal amendment process in more than ten years. The amendment vote followed afterwards and passed with more than 80% validator support.

Where the disagreement actually sits

Justin Bons of Cyber Capital said marketing XRP to retail as decentralised amounts to straight-up fraud, pointing at the expedited release and the pressure on operators to upgrade.

The XRPL Foundation answered that no single party could make that call alone, and a validator operating as XRP Kuwait put it as coordination not being the same as control, with independent operators able to reach the same conclusion without surrendering independence.

Both describe the same week. One measures who was able to decide, the other measures who in fact coordinated, and the week supports either reading.

What is checkable later

The amendment passed with over 80%, which is a published number, and the lag between the binaries and the source release is also a matter of record. XRP trades at $1.41 with a market cap of $89.2bn, and the ledger moved 929 million XRP in payments on a single day this month.

A process bypassed once under a real threat sets a precedent, and the second emergency is the test. We wrote on 6 October about a chart target for XRP that carried no condition for being wrong; this one carries a clear one, and it arrives on its own schedule.

Informational material, not investment advice. No exploitation has been found on any public network, and the disagreement described here concerns process rather than proven harm.