What actually happened?
According to CoinDesk [1], researchers demonstrated a bug in the XRP Ledger (the public blockchain tied to the XRP token) that had existed for roughly ten years. The bug allowed a payment to create spendable XRP without the sender actually backing those funds. In other words: in principle, value could be generated "out of nothing."
The response was an emergency software release that fixed the vulnerability. This is the core of the confirmed part of the story.
How big was the risk in theory?
The headline talks about "billions of dollars in XRP." Here it is important to separate potential from reality. CoinDesk [1] describes a mechanism through which it would be possible to create funds without backing. That is a description of the theoretical capacity of the bug, not confirmation that such abuse actually took place on a large scale.
Whether the bug was ever actually exploited in production, and to what extent, is not clearly indicated by the available source. Until the primary source or the XRP Ledger team confirms it, we treat it as unknown.
Why it is important not to conflate this with the Ledger hardware wallet case
These days two different reports are circulating, linked only by the word "Ledger." But these are two completely independent things:
| Case | What it is about | Source |
|---|---|---|
| XRP Ledger bug | A bug in the XRP Ledger protocol, emergency fix | [1] |
| Ledger (hardware wallets) | Losses of funds linked to the CryptoBilis reseller in Southeast Asia | [3], [4] |
"XRP Ledger" is a blockchain. "Ledger" is a maker of hardware wallets. They are different entities and different incidents. The mix-up is easy here, which is why we mention it explicitly.
What is going on in that other case (Ledger hardware)?
For completeness and to avoid confusion: according to CryptoSlate [3], the volume of suspicious losses linked to device purchases from the authorized reseller CryptoBilis approached 90 million dollars. In a statement from October 9 [3], Ledger said it was investigating the incident and had asked the reseller to immediately suspend sales and shipment of devices. The company advised caution to users who purchased within roughly the last 90 days [3].
Cointelegraph [4] reports that researchers estimate the suspicious thefts in the range of roughly 72 to 86 million dollars. The Defiant [2] describes the movement of part of the stolen funds: according to records on Tron, a conversion of 2 million USDT took place through the USDD stabilization module, while Bitquery estimates that Tether froze around 10 million dollars across a broader cluster of addresses linked to the theft [2].
These estimates differ between sources (72 to 90 million dollars), which is common in an ongoing investigation. Treat the numbers as provisional, not final.
What to watch for in similar cases
This is not advice on what to do with your money. It is a list of things worth tracking in this type of event:
- Official confirmation of scope. For the XRP Ledger bug, there is still no publicly verified confirmation of whether and to what extent it was actually exploited.
- Separating the protocol from the company. The same name does not mean the same incident.
- The evolution of damage estimates. In the hardware wallet case, the numbers change while the investigation is ongoing.
- Freezing and movement of funds. Steps like Tether freezing USDT [2][3] show where stolen funds are being moved and where they hit control mechanisms.
What is confirmed and what is not
Confirmed: the existence and fix of the bug in the XRP Ledger [1]. Unclear: whether and to what extent the bug was actually exploited. A separate case: losses linked to the Ledger hardware wallet reseller [3][4], with a completely different origin.