Shareholders of Ripple and Arrington Capital’s XRP treasury stock Evernorth Holdings would have surely loved to know that hackers could have inflated the supply of XRP by trillions of new tokens before they decided last month whether to move forward with a plan to take an XRP crypto treasury company public.
No one told them, while their share redemption window was open prior to September 28, that the XRP Ledger’s base layer payment engine had a bug allowing hackers to mint trillions of new XRP — trading today near $1.35 apiece — for almost nothing.
That bug made the fixed-supply promises of countless XRP proponents, including Evernorth CEO Asheesh Birla’s claim that 100 billion XRP was a ceiling that would never move, unenforceable on the network itself.
“All 100 billion XRP tokens were created at the time of the XRP Ledger’s launch in 2012,” Evernorth’s proxy filing read. In fact, hackers could have minted orders of magnitude more over the past decade.
How XRP lost its first 32,569 ledgers — and why it matters
Read more: Ripple pushes urgent XRPL patch — but nodes must trust its new key
Voting in an information vacuum about XRP
Although validators on the XRP Ledger have patched the bug, its existence amid Evernorth’s shareholder redemption offer is remarkable.
According to the official story, unbeknownst to XRPN shareholders — and almost everybody else on the planet — an ethical researcher privately reported the bug to Ripple’s developer arm on September 22.
Ripple then shipped an emergency, closed-source fix on September 25, obscuring that release in veiled language about “integer-arithmetic hardening.”
Shareholders faced a September 28 redemption deadline to redeem XRPN shares for cash and/or back out of the plan to merge Evernorth, an XRP treasury stock whose core value proposition rests on XRP’s limited supply, onto public markets.
The vote to proceed onto Nasdaq passed on September 30, and the merger closed on October 9.
Only on that date, October 9, did an official report admit what the September 25 “integer-arithmetic hardening” patch actually fixed: a catastrophic inflation bugthat could have sent the price of XRP to near-$0.
Fortunately, the network got lucky and no one actually exploited the vulnerability while it was active.
Still, XRPN shareholders made irreversible decisions within that time window.
XRPL Fixes Decade-Old Bug That Could Have Minted Trillions of XRP RippleX and the XRP Ledger Foundation disclosed that a critical payment-engine overflow bug could have allowed an attacker to create spendable XRP beyond the network’s fixed supply using a specially crafted… pic.twitter.com/10KyajC1Ms — Wu Blockchain (@WuBlockchain) October 11, 2026
‘That number will never change’
Birla, a former Ripple executive and the CEO of XRPN, said on the SPAC Insider podcast, in a transcript Evernorth filed with the SEC, that “XRP is a pre-mined digital asset. One hundred billion XRP were created at inception, and that number will never change. A significant portion is held in escrow by Ripple.”
Although that number has technically never changed, it certainly could have if another researcher had utilized that inflation bug.
The flaw, per the official report, likely went back to 2015.
Researcher Cayden Liao and Veria AI reported the “overflow” issue, a euphemism for an inflation bug, on September 22 through a bug bounty program.
RippleX and the XRP Ledger Foundation reproduced the exploit, escalated its severity rating to critical, and paid the bounty.
The patch shipped September 25 in xrpld 3.4.1, with no amendment vote.
XRPN pitched XRP’s capped supply that almost wasn’t
The bug report states that a single validated transaction using the exploit “could have created spendable XRP far beyond the total supply.”
Ripple Labs is an investor in and named counterparty to the business combination agreement that took Evernorth public.
Evernorth’s registration statement carried generic boilerplate. It said the cryptography underlying the XRP Ledger could “be flawed or ineffective,” per the prospectus shareholders received.
Nothing disclosed, while the XRPN redemption window was open prior to September 30 vote, that the XRP supply cap was technically meaningless for most of the XRP Ledger’s existence.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
