Why a bug that could have threatened XRP's 100 billion supply cap stayed hidden for years

In the XRP Ledger case, the flaw meant that once a transaction size exceeded the system's maximum allowed numerical limit, the value wrapped around to a very small number. That bypassed standard fund checks, crediting sellers their full XRP amounts while charging buyers next to nothing, effectively minting the difference out of thin air and artificially inflating the total XRP supply.

An attacker could have set up dummy accounts to post fake token sales worth astronomical amounts of XRP. Then, acting as the buyer, the attacker could have paid in XRP, buying all tokens at once. The ledger would credit the seller accounts with billions of valid XRP and, overwhelmed by the sheer amount of XRP, would have registered a total cost of only a fraction of a cent for the buyer.

By bypassing standard fund checks, the system would effectively mint the difference out of thin air, allowing the attacker to walk away with billions of new XRP to liquidate on external exchanges.

Why it went unnoticed?

The bug went unnoticed mainly because it required a massive scale of action to trigger, the XRP Foundation said in an explainer published Monday.

“No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations,” it said.