The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let's clear them up.

1. Was any XRP created?

No. XRP's supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around that rule, and 3.4.1 fixed over 2 weeks ago.

You don't need to trust us on this. All ledger data is public, and explorers and data sites read it every day. New XRP would show up in account balances for everyone to see. There is no hidden place for XRP on the XRP Ledger, every balance is public.

We monitor the XRP Ledger 24/7 and have verified the supply throughout the history of the ledger. Others in the community verified this too, and anyone can do the same.

Transaction fees are destroyed, so the supply is deflationary. About 99.986 billion XRP exist today.

2. How did this go unnoticed, and what's next?

No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations.

AI makes bugs like this faster to find, for the bad guys and the good guys.

Together with RippleX and the community, we will ensure the XRP Ledger is protected against such vulnerabilities. This means radically applying Formal Verification and AI adversarial testing, collaborating closely with security researchers, and strengthening the bug bounty program.

You'll hear a lot more about this as we progress.

3. XRP Ledger decentralization at the core of this.

A public fix shows attackers where the bug is, and AI makes that fast. With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security.

As a reaction to this, the XRPL community came together, and among them the XRP Ledger Foundation, RippleX, core devs and validators formed a social consensus and agreed on a path forward that involves shipping the fix directly. Patching a live network is never trivial, so the plan was also designed to minimize disruption for everyone running on it.

We shared the build with the default UNL validators, using the contact details each one publishes in its xrp-ledger.toml file. Public binaries followed the same day, September 25. The source code and full report came out on October 9.

No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments.

Big thanks to Cayden Liao and Veria AI for finding and reporting this responsibly, to the XRPL core developers for building and testing the fix, and to every node operator who upgraded so quickly, especially the validators.

Full report: https://xrpl.org/blog/2026/vulnerabilitydisclosurereport-bug-20261009