XRP Ledger Patches Critical Payment Engine Bug That Could Have Allowed Counterfeit XRP Since 2015

XRP Ledger maintainers disclosed and patched an integer overflow bug in the payment engine, reported via bug bounty in September, which could have allowed an attacker to create counterfeit XRP. The flaw, present since the payment engine was written in 2015, went unnoticed because normal payments did not trigger it, and the ledger's safety check used the same flawed arithmetic. The fix, version 3.4.1, shipped on Sept. 25, and over 80% of trusted validators were running it that day; the patch bypassed the usual two-week amendment process due to severity. Developers state there is no evidence the bug was ever exploited.