XRP Ledger Foundation: Confirmed that no new XRP has been created, critical vulnerability has been fixed

The XRP Ledger Foundation published a post on platform X to clarify the recent security vulnerability incident of the XRP Ledger, stating that the vulnerability could be used to bypass the limit of the total supply of XRP fixed at 100 billion coins, but it was fixed two weeks ago with version 3.4.1. After verification, no new XRP has been created, and the total amount of XRP currently circulating in the ledger is approximately 99.986 billion coins.

The foundation stated that the vulnerability requires hundreds of deliberately constructed operations to trigger and that normal payment transactions are unlikely to be involved. In the future, they will strengthen formal verification, AI adversarial testing, security research collaboration, and vulnerability bounty programs with RippleX and the community. Regarding the repair process, the foundation explained that publicly releasing a patch could allow attackers to use AI to accelerate vulnerability analysis. To address this situation, the XRPL community coordinated efforts. Participants including the XRP Ledger Foundation, RippleX, core developers, and validators reached a social consensus to agree on a plan to directly release the repair program.

In addition, version 3.4.1 was also adopted as the mandatory version for the network only after going through the normal amendment voting process and receiving over 80% support from validators for two consecutive weeks. Protocol changes still need to be completed through the amendment mechanism. Previously, J. Ayo Akinyele, the engineering lead at RippleX, also posted on platform X expressing high concern about the recently disclosed critical vulnerability issue in the XRP Ledger (XRPL) payment engine, which is a serious security issue that has existed in the codebase for over 10 years and theoretically could lead to XRP being over-created, breaking the fixed supply limit. However, the vulnerability was discovered by the security research organization Veria AI through Ripple's vulnerability bounty program before it could be exploited.