XRP Ledger Emergency Patch Sparks Decentralization Debate

The XRP Ledger Foundation has responded to criticism over its emergency patch that fixed a bug capable of creating unlimited XRP.

The fix arrived on Sept. 25, just three days after a bounty report exposed the flaw. It marked the first time developers bypassed the standard two-week validator voting process in over a decade.

XRPL developers said waiting weeks would have publicized the vulnerability before it was fixed, putting the whole network at risk.

Cyber Capital founder Justin Bons called the marketing of XRP as decentralized “straight-up fraud.” He noted the patch shipped as binaries only, with source code temporarily withheld.

How Validators Responded

The Foundation said the decision was made jointly, and the 3.4.1 update later passed through a normal amendment vote with over 80% validator support. Independent validator XRP Kuwait argued that coordination does not equal control.

Integer Overflow Bug Details

The bug, present since 2015, involved an integer overflow in the payment engine. Attackers could craft special offers so the system credited full amounts while charging only a tiny wrapped total effectively minting new XRP.

Developers confirmed no exploitation occurred on any public network.