Researchers demonstrated how a payment could create spendable XRP without the sender funding it, prompting an emergency software release.