XRP Ledger developers released an emergency patch after researchers demonstrated a payment that could create spendable XRP without the sender funding it. The decade-old flaw could have let someone mint XRP from nothing. That matters because it strikes at the Ledger's core promise: a fixed, trustworthy supply.
What actually happened
According to CoinDesk, researchers demonstrated how a payment on the XRP Ledger could create spendable XRP without the sender funding it. CoinDesk reports the bug had existed for roughly a decade before discovery. The report states that developers responded with an emergency software release to patch the flaw. XRP Ledger's design is meant to cap total supply at a fixed amount, so a flaw allowing new XRP to appear from nothing would directly undermine that guarantee. CoinDesk's report does not name the researchers, give an exact discovery date, or state whether the bug was ever exploited before the patch shipped.
How we got here
XRP Ledger is built around a fixed, capped supply, a feature often cited as a core trust guarantee for holders. Bugs that threaten supply integrity differ from ordinary software bugs, because they strike at a network's basic value proposition rather than just its performance. CoinDesk's report says this flaw had gone unnoticed for about a decade, a reminder that even established, widely used blockchains can carry undiscovered issues for years. The discovery followed research aimed at probing how payments function at a protocol level, rather than a routine audit. Details on what prompted that research are not included in the available report.
Why this matters for you
For XRP holders, the patch matters because an exploited bug could have diluted the token's fixed supply, undermining value for everyone holding it. For exchanges and custodians, verifying they run patched Ledger software becomes an immediate priority. For developers building on XRP Ledger, including wallets and payment apps, this is a reminder to track validator and node updates closely rather than assuming infrastructure is static. For the wider Web3 and connected-hardware ecosystem that depends on reliable settlement layers, incidents like this reinforce why protocol-level security audits matter as more real-world value and devices connect to blockchain rails.
The bigger question
If a decade-old flaw could let someone create XRP from nothing, how many other widely used blockchains carry similar undiscovered vulnerabilities in their core supply logic? The incident raises a broader question for the industry: how much blind trust do users place in mature, audited-seeming networks, and how often should that trust be re-tested?
What to watch
CoinDesk published its report on 10 October 2026. Watch for official confirmation from XRP Ledger validators that the patch has been widely adopted. Watch also for any follow-up disclosure naming the researchers or detailing whether the flaw was ever exploited. Further technical post-mortems from the XRP Ledger development community would clarify the full scope of the risk.
