XRP Ledger Bug Dating to 2015 Could Have Counterfeited XRP
An integer overflow in the XRP Ledger's payment engine sat dormant for years and could have let an attacker mint spendable XRP beyond the token's total supply.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- The flaw was an integer overflow in the XRP Ledger's payment engine.
- It has been dormant since 2015.
- In theory, an attacker could have created spendable XRP beyond the fixed total supply.
- The details available so far are thin: no exploitation, patch timeline or losses are confirmed in the source material.
A bug has been sitting in the XRP Ledger's payment engine since 2015, and it could have let an attacker counterfeit XRP. That's according to a Decrypt report published October 12. The flaw is an integer overflow. In theory, it would have allowed someone to mint spendable XRP beyond the token's total supply.
What we know
The problem lived in the payment engine, the part of the ledger that governs how value moves between accounts. It dates to 2015. It stayed dormant. That's the full confirmed picture for now.
Some background on the mechanics. An integer overflow happens when a calculation produces a number bigger than the space set aside to store it. The value wraps around or breaks, and the software can land on a wrong result. In a payment system, bad math can mean money that shouldn't exist.
What we don't know
Quite a bit. The source material doesn't say whether anyone exploited the bug. It doesn't say how the flaw was found, who found it, or how and when it was fixed. Until those answers arrive, treat any claim of real losses or active attacks as unconfirmed. We'll update if more detail emerges.
Why it matters
Part of XRP's pitch is a hard cap on supply. A bug that can break that cap goes straight at the core of the asset's value, so a flaw like this matters even if nobody ever used it. Holders should watch for two things: an official postmortem from the people who maintain the ledger, and confirmation that the problem is closed. Eleven years is a long time for a flaw to hide in core code. So who's checking the old corners of other chains?
Source: Decrypt
Top Crypto Casinos Right Now
🇹🇷 Showing sites that accept players from Turkey Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-facing book that pays a premium for crypto deposits: 125% against 100% for cash, with fee-free deposits across five coins.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
More info Less info
Why we chose it: Phemex is a derivatives-first venue for Europe, Asia and Latin America. Good engine, mid-size liquidity, and a blocklist that grew in 2025.
- Online since
- 2019
- Licence
- Seychelles
- KYC
- Required
Restricted countries: United Arab Emirates, Afghanistan, Australia, Belgium, Bermuda, Belarus, Ontario (Canada), China and 18 more.
More info Less info
Why we chose it: BetNow's casino floor with the biggest match bonus we list. The 200% headline deserves a careful read of the code terms behind it.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
Daniel Okoro
Daniel tracks crypto regulation and policy across the US, EU and Asia, with a decade in financial journalism.
