From Coinpedia · By Sohrab Khawas
The XRP Ledger (XRPL) disclosed two software vulnerabilities on October 9, 2026, including a critical bug that could have allowed attackers to create new, spendable XRP. The second flaw affected the network’s Batch transaction feature and could have disrupted transaction validation.
According to the official report, the payment engine bug was fixed in xrpld version 3.4.1, released on September 25. XRPL reported no evidence that the vulnerability had been exploited on any public network.
XRPL Bug Could Have Created New XRP
The critical vulnerability affected how the payment engine calculated the XRP required to complete trades across multiple offers in an order book. The calculation could overflow when the combined amount exceeded the maximum value supported by the system. This could cause the payment engine to charge a buyer less XRP than the amount credited to offer owners, effectively creating new XRP.
Exploiting the bug required a carefully prepared order book containing hundreds of offers with unusually high prices, followed by a specific payment transaction. The vulnerability could not be triggered through ordinary payments or trades.
A researcher reported the issue through the XRPL Bug Bounty program on September 22, 2026. The RippleX engineering team reproduced the bug and confirmed that any XRP created through the flaw could be spent.
The issue was fixed in version 3.4.1. Developers added checks to prevent the calculation from overflowing and strengthened the system’s safeguards against unauthorized XRP creation.
Second Bug Affected XRPL Batch Transactions
The second vulnerability involved the XRP Ledger’s Batch transaction feature, which allows users to submit multiple transactions together. The flaw allowed a transaction inside a batch to use an incorrectly structured field. The server could still accept and process the transaction.
This created a risk that different versions of XRPL software could disagree on whether a transaction was valid. Such disagreements could prevent validators from reaching consensus and interrupt ledger validation.
The issue did not allow attackers to bypass transaction signatures or directly steal funds, according to the report.
XRPL addressed the flaw through the fixBatchV1_2 amendment, which requires transactions to use the correct structure. The Batch feature had not been activated on the mainnet when the vulnerability was identified, so the report did not identify any mainnet accounts or funds affected by this bug.
XRPL Activates Batch Security Fix
XRPL developers and validator operators withdrew support for the original Batch amendment to reset its activation timeline while the team prepared the fix.