XRP Ledger developers released on September 25, 2026 an emergency patch xrpld 3.4.1 fixing critical security vulnerabilities in the XRPL protocol. This overflow bug, present in the payment engine since 2015, would have allowed an attacker to create spendable XRP beyond the total supply by exploiting an integer overflow when processing a single payment consuming multiple offers from the order book. The payment amounts were represented as integers with a fixed maximum: when a sum surpassed that maximum, it wrapped around to a small number, causing the engine to pay each offer owner their full amount individually while charging the buyer only the wrapped-around total, with the difference being newly minted XRP. The fix was applied immediately without the usual amendment process, marking the first time this has happened since the amendment system was introduced over ten years ago, and no exploitation on any public network was detected.
Source: Read the original article
