XRP Ledger Bug Could Have Created 18 Trillion XRP: What Happened

A single transaction on the XRP Ledger could have created more than 18 trillion XRP out of nothing, according to a recent Bullrunners video. That is roughly 184 times the 100 billion XRP that will ever exist. It was not a hacked wallet or a scam app. The flaw sat inside the ledger’s own code, and the video says it had been there since 2015, surviving years of audits.

For XRP holders, the fixed supply is a core part of the case for the asset. So the questions matter: how did the flaw work, who caught it, was it ever used, and why did the fix break with more than a decade of procedure? The video also covers where Bitcoin stands heading into a busy week of economic data.

How could one transaction create 18 trillion XRP?

The flaw relied on a math error in the XRP Ledger’s built-in exchange, where accounts post offers to swap one token for another. According to the video, the attack worked in two steps:

1. An attacker posts hundreds of offers, each selling a tiny amount of a token for an unusually large amount of XRP.
2. The attacker sends a single payment that fills every one of those offers at once.

The total XRP owed becomes too large for the software to handle. Instead of failing, the number wraps around to a tiny value, much like a car’s odometer rolling back to zero. This is known as an overflow. The sellers get paid in full, the buyer pays almost nothing, and the difference is XRP that never existed before.

No one needed to break into anything. As the video puts it, it needed just one payment.

Why didn’t the safeguards stop it?

Two protections were in place, and both missed the problem, according to the video:

• The check designed to stop new XRP from appearing used the same broken math, so it could not see the error.
• The cap on any single account’s balance could be avoided by splitting the newly created XRP across hundreds of accounts.

This is how a flaw from 2015 got past years of audits and the people paid to look for exactly this kind of issue.

Who found the XRP Ledger flaw?

An AI agent built by a security startup found it, not a human reviewer. The video says the startup reported on September 22 that its agent had found both weaknesses and built a working attack to prove they were real.

The AI did not get the final word. Engineers at RippleX, the team behind much of the ledger’s development, reproduced the attack themselves and rated it critical. The startup was paid a record $250,000 bounty.

The video points out why this matters beyond XRP. Years of human review walked past the flaw, and software caught it. The same kind of AI tools are available to attackers too. This time, the people who found it reported it.

Was the flaw ever exploited?

As far as anyone can tell, no. According to the video, RippleX found no evidence the flaw was used on the public network, and a check of the XRP Ledger’s entire history shows the supply just under 100 billion XRP. In other words, no fake XRP ever got out.

Why did the fix skip the validator vote?

The fix skipped the normal vote because the vote itself would have exposed the flaw. Normally, changing how the XRP Ledger works requires more than 80% of trusted validators (the servers that agree on the ledger’s state) to back a change for two weeks straight. Because the code is public, publishing the fix would have shown attackers exactly where the weakness was, and they would have had two full weeks to use it.

So, for the first time in more than 10 years, the process was bypassed. Here is the timeline the video describes:

1. September 22: The flaw is reported.
2. September 25: The fix is sent privately to the main validators and ships. More than 80% are running it on day one.
3. October 9: The public learns about the flaw, after the fix is already in place.

Moving that fast had costs, and the video does not hide them:

Trade-off	What it meant
Code not public	For about two weeks, validators ran software nobody outside could check. Some people criticized this.
Uneven upgrade risk	If some servers upgraded and others did not, the network could have briefly stopped processing transactions.
Speed	The flaw was closed in three days instead of being exposed for two weeks.

According to the video, RippleX decided both risks were worth taking to stop anyone from printing more XRP. Holders can reasonably disagree on that call, and it is worth knowing that developers and validators can make decisions like this without a public vote.

What else happened for XRP after the disclosure?

Institutional activity continued in the days after the news went public. The video highlights two developments:

• Evernorth listed on Nasdaq under the ticker XRPN. The video describes it as the first public company built to hold XRP, with about 473 million XRP on its books, comparing it to what Strategy does for Bitcoin. It is a stock rather than the coin, so buyers are also betting on how the company is run.
• Standard Chartered launched custody for RLUSD on the XRP Ledger. RLUSD is Ripple’s stablecoin, backed one-to-one by the US dollar. The London-based bank, which operates in more than 50 markets, holds and protects RLUSD for institutional clients.

Where does Bitcoin stand right now?

Bitcoin was trading around $83,700 at the time of the video, just under the $84,000 level many analysts are watching. Key points from the video:

• Bitcoin has closed four weeks in a row above its 50-week average, which sits near $76,600.
• Glassnode’s ratio comparing Bitcoin’s price with what holders paid for their coins has risen to 1.54, above its yearly average of 1.44. The video says the last two similar crossovers came in 2019 and 2023, both early in recoveries.
• Strategy, led by executive chairman Michael Saylor, added another 250 BTC, roughly $21 million worth, bringing its holdings to about $70.7 billion.
• Bitwise chief investment officer Matt Hougan said he expects renewed investor excitement to start north of $100,000 and accelerate at new all-time highs. That is his view, not a forecast from Bullrunners.

Analysts cited in the video see a clean break above $84,000 as a possible trigger toward $90,000. That remains speculation until it happens.

A quick concentration check for your portfolio

The video’s main lesson is not about the bug itself. Nobody could have predicted a 10-year-old flaw, and this story ended well. But if one coin has quietly become most of what you own, a single surprise can shape your entire year. The video suggests asking yourself:

1. What share of my portfolio is in my single biggest holding?
2. If something serious hit that coin, how exposed would I be?
3. Do I have a plan written down for that situation, or would I be deciding in the moment?
4. Am I following security disclosures, ledger upgrades and validator decisions for each network I hold?

If you cannot answer these quickly, that is useful information on its own.

What to watch next

For Bitcoin, the video flags a run of economic data: OPEC’s monthly oil report on Tuesday, September CPI on Wednesday, and PPI on Thursday, followed the same day by remarks from Fed Chair Kevin Warsh. Cooler numbers could help Bitcoin clear $84,000, while hotter ones could keep it below that line.

For XRP, keep an eye on any further RippleX disclosures about the flaw, how the community responds to the decision to skip the validator vote, and whether institutional products like Evernorth’s listing and Standard Chartered’s RLUSD custody draw real activity on the ledger.