Hidden 10-Year XRP Bug Could Have Let Hackers Fake Money

A major security hole that sat hidden for almost a decade could have let hackers create fake XRP coins out of nothing. The good news: it's now fixed, and there's no evidence anyone ever used it.

The problem was found in the XRP Ledger (the software system that records and processes XRP transactions). A security researcher reported it in September through a bug bounty program (a reward scheme that pays people for finding software flaws).

What went wrong? The flaw was something called an integer overflow — basically, when a number gets too big for the system to handle, it "wraps around" to a tiny number by mistake. Here's how an attacker could have abused it:

• They would make one big payment that used hundreds of specially crafted buy/sell orders at once.
• The total amount owed would overflow and reset to almost nothing.
• The system paid sellers in full but charged the buyer almost zero.
• The leftover difference became brand-new, fake XRP that should never have existed.

Even worse, the ledger has a safety check meant to confirm no new XRP is ever created — but that check used the same broken math, so it failed to catch the problem.

Key facts:

• The bug had been in the code since 2015.
• It went unnoticed because no normal payment ever comes close to triggering it.
• The fix shipped on Sept. 25 in version 3.4.1.
• Over 80% of the network's trusted validators (computers that approve transactions) were running the fix that same day.

Developers rushed the patch out fast, skipping the usual two-week voting process, because releasing the open-source fix would have revealed the bug and left it exploitable for weeks.

This echoes a similar counterfeiting scare at Zcash earlier this year, which caused that coin's price to tumble.

Meanwhile, XRP's price dipped. The token traded at $1.38 on Monday — down 1.6% in 24 hours and 9.4% over the past week, the worst showing among major cryptocurrencies.

The bottom line: a serious flaw was caught and fixed before any harm was done, showing why ongoing security testing matters for crypto networks.

This is an AI-generated summary. Read the original article at: https://decrypt.co/380693/xrp-ledger-payment-engine-counterfeiting-bug-hiding