Summary of "Jagex Accidentally Gave Everyone Unlimited Gold"

Summary — what happened

On July 12, 2018, Old School RuneScape released an update that added “coin pouches” intended to prevent unattended autoclicking/botting on the thieving skill. Pouches were meant to act as an intermediate item (non-stackable or partly stackable) that converted to coins when opened, forcing player attention.
A coding error in the death-conversion routine caused almost any stackable item (except properly handled coin pouches) to convert into a single stack of the game’s integer cash limit: approximately 2,147,483,647 GP.
Within minutes PvP worlds were flooded: dying players produced stacks of this max cash everywhere. Trillions of GP spread across players, the Grand Exchange, trades, and dropped items. Players began handing out billions, buying bonds, and triggering rapid, massive inflation.
Jagex shut servers about 19 minutes after the update, investigated, and performed a full rollback to the pre-update state after several hours of downtime. The rollback restored accounts, with special handling for bond purchases made using glitched gold.

Thieving before the change: pickpocketing NPCs yields coins directly. At high levels, failure and damage are rare, and some NPCs could be trapped so players could click one spot for hours — ideal for autoclickers and bots.
Jagex’s fix: introduce coin pouches so pickpocket success grants pouches instead of immediate coins. Pouches were intended to be either non-stackable or stackable only up to a limit, requiring players to open them manually and breaking simple autoclicking routines.
Targeted concerns: prevent autoclick bots while preserving XP rates; consider low-level thievers and ultimate ironmen who have inventory and banking constraints.

Death-conversion code needed a safety check to ensure converting pouches to coins wouldn’t overflow the maximum integer for GP.
The safety check was implemented incorrectly. When scanning inventories on death it mishandled other stackable items and converted them into the max-cash value instead of leaving them alone or handling them correctly.
Coin pouches themselves converted correctly in tests, so QA missed the specific code path that only triggered for other stackable items in live scenarios.

Immediate effects: massive, very fast inflation; widespread spending and trading of glitched cash; some players bought long-term bonds with the tainted gold.
Jagex response: servers were shut down quickly; teams coordinated a rollback (which some initially thought impossible), worked across Old School and RuneScape 3 services, and restored the game to its pre-update state several hours later.
Aftermath: the bug was fixed and processes strengthened to reduce repeat risk. Players who purchased bonds with glitched gold were handled specially (transactions reversed or flagged).

For players:
- After a major update, avoid risky behavior: don’t log into PvP worlds or accept large unexplained items immediately.
- Never trust or spend unexpectedly large stacks; report suspicious items or behavior to moderators.
- If something seems “too good to be true,” assume it’s a glitch — spending or spreading the items can complicate recovery and risk sanctions.
For developers:
- Test edge cases for new item types, especially stackable behavior and death/transfer mechanics.
- Include explicit overflow and safety checks for numeric limits and verify those checks against non-standard item paths.

March 2018: Jagex blogged proposed thieving changes aimed at preventing bots.
July 12, 2018: Coin pouches update released.
~14–19 minutes after release: players began finding stacks of max cash; PvP worlds filled with glitched stacks; first public posts and streamer clips appeared.
~19 minutes after update: Jagex shut servers to investigate.
A few hours after shutdown: Jagex announced rollback work affecting Old School and some RS3 services.
~6+ hours after shutdown: rollback completed and servers restored to the pre-update state (with special handling for bonds bought with glitched gold).