XRP's Cap Was Optional: The Ten-Year Overflow Bug and the Vote That Happened Blind

Alert. The XRP Ledger carried a live integer-overflow defect in its payment engine for roughly a decade — a defect capable of creating spendable XRP beyond the network's 100 billion hard cap. It is patched now. It was never exploited. That last fact is the only reason XRP still has a functioning price. Run the timeline. September 22: external researchers flag the flaw. September 25: a closed-source emergency fix ships inside xrpld 3.4.1, described in public notes only as "integer-arithmetic hardening." September 28: Evernorth shareholders hit a redemption deadline. September 30: the listing vote passes. October 9: the merger closes, and the market finally learns what nearly happened. Signal confirms. The bug is dead. The disclosure problem is very much alive. And the people who made irreversible decisions inside that window did so with zero visibility into the single fact that mattered most. XRPL is a payments-first Layer 1. Genesis block, 2012. All 100 billion XRP were minted at inception — no inflation schedule, no staking emission, no governance token attached. That pre-mine is the entire investment thesis. XRP is a bridge asset and a settlement medium, and its valuation rests on one load-bearing claim: the supply number cannot move. Ever. Ripple escrows a large share of that supply and releases it on a schedule. The rest circulates. There is no protocol revenue, no dividend, no yield, no cash flow. Strip away the scarcity story and XRP is a settlement rail with a price tag attached. Evernorth is the newest wrapper on that story — an XRP treasury company, a listed vehicle whose net asset value is levered to the XRP price. Arrington Capital sits in the cap table. Ripple Labs is both an investor and a named counterparty to the business combination agreement. File that structural detail. It matters. XRP traded around $1.35 when this surfaced. Hold that number. It already prices in a decade of regulatory noise, the long SEC fight, and a persistent overhang of escrowed supply hitting the market on a schedule. It does not price in what follows. Floor holding at $1.35, for now. Momentum is what I am watching. Now the technical meat, and I will not dress it up. The defect lives in the payment engine. Integer overflow. This is the kind of bug security textbooks have used as a teaching example for thirty years — value wraps past its container's maximum, and the result is spendable XRP that never existed inside the fixed 100 billion ledger. It is not a smart-contract bug. It is not a DeFi exploit. It is a failure at the layer that defines the money supply itself. The bug does not sit on top of XRP's monetary policy. It sits inside it. Traced to 2015. That is roughly ten years of mainnet operation with a live monetary-policy defect sitting in the code path. Read it again. Ten years. Every audit cycle, every security review, every "battle-tested since 2012" talking point — none caught it. External researchers Cayden Liao and Veria AI found it. Not the core team. They went through the bug bounty, Ripple reproduced it, escalated severity to critical, and paid out. So the response machinery worked. Detection did not. Those are different things, and the market keeps collapsing them into one. The fix is where I stop caring about the bug and start caring about the process. The patch shipped September 25 inside xrpld 3.4.1 — without an amendment vote. XRPL's stated design routes protocol changes through validator amendment voting. That is the decentralization claim, written into the governance model. The emergency patch bypassed it. Closed-source. Vague release notes. Done. I audited early rollup prototypes on a testnet back in 2017 where a single state-channel flaw could have drained $5 million in locked assets. I disclosed it fast and the team patched before mainnet. When you find something at that layer, the disclosure cadence is the entire game. You are no longer managing a bug. You are managing who knows what, when, and whether the people making irreversible decisions have the information to make them correctly. Here is what the timeline produced. September 22: Ripple-side entities know. September 25: a fix exists and the public description is deliberately uninformative. September 28: Evernorth shareholders face a redemption deadline. September 30: they vote the listing through. They decide blind. October 9: the merger closes and the truth lands. The supply number never changed. Technically true. The bug was never exploited, so no XRP was ever minted. Also true. Both facts are irrelevant to the actual damage, which is this: the claim that the cap is unchangeable is now known to be false at the code level. Not false because someone minted. False because the network could not enforce its own ceiling. I have watched DeFi protocols subsidize TVL with liquidity mining and call it organic growth. Pull the incentive and the users evaporate. The number was real; the claim behind it was hollow. XRP's supply cap is the same shape of illusion. The number held. The guarantee did not. Zoom out to the token model. XRP has no yield, no protocol revenue share, no governance rights. Its entire value capture is "settlement demand plus scarcity." When value capture is that thin, price rests almost entirely on narrative — and narrative is precisely what this event damaged. Ripple's escrowed supply compounds the tension: a large, scheduled, predictable source of sell pressure has always coexisted with the "absolute scarcity" pitch. Nobody reconciled those two facts. The market ignored the escrow schedule and repeated the scarcity line. The governance tell matters too. An emergency patch that skips the amendment process is understandable under time pressure. It is also a precedent. Once "critical — ship it closed-source, skip the vote" becomes acceptable, the validator set has demonstrated it can coordinate fast enough to override its own procedure. That is centralization, and it is not theoretical. It is in the changelog. The same muscle shows up in Layer 2 sequencers that have been "decentralizing" on a roadmap for two years while one operator orders every block. XRPL just flexed the same coordination in a crisis window. The mechanism is coordination. Coordination implies control. Now the tail risk nobody is pricing. If a defect like this had been exploited, the attacker mints XRP and dumps it on the native DEX. Price goes toward zero. XRP holders — including the Evernorth treasury — take a near-total loss. Evernorth is not a diversified fund. It is a levered long on XRP with a listed wrapper. Its NAV is welded to a single asset whose supply guarantee just proved non-binding. That is the exposure. Probability is now low because the bug is patched. Impact, if a sibling defect exists in the same code path, is existential. High-impact, low-probability tail risk is exactly the kind of thing that never gets priced until it does. Then there is the asymmetry that should make every XRPN holder furious. Birla publicly stated the 100 billion is a cap that never moves. In roughly the same period, Ripple knew the cap was technically breakable. Meanwhile the Evernorth prospectus carried the standard boilerplate — cryptography may be flawed or ineffective. Two statements, same organization, same window. One is marketing absolutism. One is legal hedging. The gap between them is the entire story. Here is the contrarian read. Everyone will frame this as a bug story — scary integer overflow, patched, resolved, move on. Wrong frame. This is a disclosure-timing case with a securities-law spine, and the technical details are the evidence, not the subject. The question is not "was the code broken." The question is whether a defect that could theoretically print XRP beyond the cap — and thereby drive the price toward zero if exploited — is material information that should have been disclosed before a redemption deadline and a listing vote. Run materiality the way a court would. Would a reasonable investor consider it important? A flaw threatening the treasury company's sole asset with a near-wipeout scenario? That clears the bar without strain. The counterargument is real and I will state it fairly. The bug was fixed. It was never exploited. Disclosing an un-exploited flaw can invite attackers who now know the code path existed. Industry practice permits post-fix disclosure. The prospectus carried a generic cryptography-risk clause. That defense is thin, and here is why. A generic boilerplate clause is not the same legal object as a known, specific, critical-severity defect already found, reproduced, and patched. One is a standing disclaimer about possibility. The other is a concrete event. Boilerplate covers the former. It rarely covers the latter. "Cryptography may be flawed" sitting in an S-4 does not convert a specific live vulnerability into a covered risk. Then the dual role. Ripple is a named counterparty to the Evernorth business combination and a disclosed investor. It also held the vulnerability information before the shareholder window. That is a structural conflict with no visible information barrier. If Ripple-side entities selectively shared the vulnerability with specific institutions between September 22 and October 9, this stops being a disclosure omission and becomes an insider-information problem. I have no evidence of that. I am flagging the architecture, not the act. But it is exactly the architecture regulators build cases around. The arb window here is not on a DEX. It is information. Informed parties held a material non-public fact across a window that overlapped two irreversible shareholder decisions. Arb window closing. Execute — except the people who could have executed were the ones kept in the dark. Second-order problem for the whole asset class: ten years of survivorship bias just got repriced. "Running since 2012" was treated as a security credential. In this case it meant ten years of un-caught exposure. Age is not a substitute for audit depth. Anyone using longevity as a proxy for safety should re-run their assumptions across every pre-mine chain selling an absolutist scarcity narrative. Watch three things. First, whether the SEC opens even an informal inquiry into the disclosure window — that is the live wire, not the code. Second, whether the emergency-patch precedent gets normalized; the next "critical, skip the vote" moment tells you whether XRPL's governance is real or decorative. Third, whether the market ever reprices the scarcity premium — because the number held, but the guarantee did not, and only one of those was ever in the price. The bug is dead. The question of who knew, and when they chose to stay quiet, is not. Momentum shifting. Watch the floor.