There has been a lot of talk about the recent XRP Ledger overflow bug. It was a serious vulnerability, but it’s also an example of responsible disclosure working. Researchers reported it privately, developers built a fix, and validators upgraded before any known exploitation on a public network. The XRP Ledger’s account-based model lets you inspect every account’s XRP balance. Include XRP held in escrows and payment channels, which are also public, and you can audit holdings across the entire ledger. There isn’t some hidden place where newly created XRP could sit outside that accounting. The XRP Ledger isn’t the only blockchain to have had this sort of vulnerability. Bitcoin had the same class of bug, an integer overflow, in 2010. Unlike the recent XRP Ledger vulnerability, Bitcoin’s bug *was* exploited, creating more than 184 billion BTC out of thin air. Its developers, miners and node operators then had to coordinate a fix and reorganise the chain to remove the exploit. Half a bitcoin in, 184 billion out On 15 August 2010, Bitcoin block 74,638 included a transaction that spent just 0.5 BTC and produced two outputs of roughly 92.2 billion BTC each. Quite a lot for a system intended to have a maximum supply of 21 million. Jeff Garzik flagged it on the Bitcoin forum in a thread titled “Strange block 74638”. The discussion is still available, and you can read people working through the incident as it unfolded. The problem was in the arithmetic used to validate transactions. Bitcoin stores amounts as whole numbers of satoshis, with 100 million satoshis to one BTC. The software checked that individual outputs weren’t negative, but it didn’t adequately check their upper limits or prevent overflow when adding them together. A computer integer has a fixed amount of space. If a calculation exceeds what it can hold, it can overflow. In this case, adding two enormous positive values produced a negative total, which slipped through the checks intended to prevent a transaction spending more than its inputs. Nobody had broken the cryptography or defeated proof of work. The software checking whether the money added up had got the answer wrong. The recent XRP Ledger bug involved the same class of failure. A deliberately constructed payment could credit hundreds of offer owners their full XRP amounts, while the total charged to the buyer overflowed to a much smaller number. The difference would be newly created, spendable XRP. Its “no XRP created” safety check also used arithmetic that could overflow in the same way. The fix added overflow checks and changed that safety check to use a wider counter. Fixing Bitcoin meant *replacing accepted history* Gavin Andresen posted an initial patch, and Satoshi Nakamoto followed with additional checks. A patch was committed within hours of the public discovery, with the fix released in Bitcoin version 0.3.10. But the exploit transaction was already in a block, and miners were building on top of it. Fixing the software wouldn’t, by itself, remove the billions of BTC already accepted by the network. Satoshi asked people to stop mining temporarily so there would be less affected history to replace. Upgraded participants rejected the bad block and built an alternative branch from before it, excluding the exploit. For a while, two branches competed. Unpatched miners continued extending the affected branch, while upgraded miners extended the corrected one. The corrected branch overtook the other at height 74,691 and became the accepted Bitcoin chain. The exploit transaction was excluded from that history, so the BTC it had created no longer existed on the accepted chain. I think this is useful context for the current discussion. A supply limit written into a protocol still depends on software correctly checking every transaction. Both networks had integer overflow vulnerabilities in the calculations intended to enforce their monetary rules. Bitcoin’s was exploited and required an emergency recovery and rewriting Bitcoin's history. The XRP Ledger’s was responsibly disclosed and fixed before any known public-network exploitation. That doesn’t make the XRP Ledger bug less serious. It does mean the researchers who reported it and the operators who acted quickly deserve credit. Finding and fixing a critical vulnerability before it causes damage is exactly what we want a security programme to achieve.