XRP Ledger Developers Deploy Emergency Patch to Fix Nine-Year-Old Token Minting Flaw

XRP Ledger developers deployed an emergency software patch to resolve a critical integer overflow vulnerability that could have allowed attackers to mint unlimited unbacked crypto tokens. Discovered on September 22 by researcher Cayden Liao, the flaw existed in the network's payment engine since 2015 and permitted a single rigged transaction to bypass the ledger's fixed supply constraints.

Bypassing Standard Validator Votes

To prevent exploitation during the network's mandatory two-week voting window for protocol amendments, developers shipped the fix as a closed-source binary update, skipping the standard validator voting process. This marked the first time a change to transaction processing was pushed deliberately without a vote since the amendment system was introduced over a decade ago, according to the official vulnerability disclosure report published on XRPL.org.

More than 80 percent of the 35 designated validator nodes adopted the emergency xrpld software patch within 24 hours of its release on September 25. The updated code, which implemented integer-arithmetic hardening in the payment engine and ledger helpers, was subsequently published to GitHub.

Centralization Concerns Resurface

The rapid remediation underscores ongoing structural debates regarding the centralization of the XRP Ledger, as a limited number of hand-picked operators swiftly coordinated an unannounced rule change. While Ripple developers stated they found no evidence of exploitation on any public network, the incident highlights the systemic risks embedded in legacy distributed ledger codebases where emergency central coordination is required to mitigate critical failures.