XRP News: The XRP Ledger Is Fixing a Flaw That Could Have Let Partners Print Extra Stablecoins. How Big a Risk Was It?
A new delegation feature on the XRP Ledger quietly introduced a way for partner accounts to mint stablecoins they were only supposed to burn, and the window for exploitation may not have closed yet.
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
A vulnerability in the XRP Ledger could have allowed partner accounts to mint extra stablecoins without the issuer’s approval. This issue arose from a feature designed for stablecoin issuers, where an account authorized solely to burn an issuer’s tokens could, in certain cases, create new ones instead. A set of bug fixes known as fixCleanup3_4_0 is scheduled to resolve this XRP Ledger flaw at 14:46 UTC on November 4, 2026.
Ordinary account holders could not exploit this flaw. Only a delegate—an external account the issuer gave a specific permission called PaymentBurn—could have been positioned to mint additional tokens. The XRP Ledger documentation advises issuers not to delegate PaymentBurn until after the fix is implemented.
Despite the news, XRP (CRYPTO: XRP) hasn’t sold off, trading at $1.28, up 2.6% over the past 24 hours and 64.9% below its all-time high. The warning pertains only to tokens generated on the ledger, not to new XRP itself.
A Helper Account Designed to Burn Tokens Could Also Mint Them
The flaw lies in Permission Delegation, a feature introduced on October 8 through an amendment approved by validators—independent servers that agree on valid transactions. Delegation lets account owners, like stablecoin issuers, give another account specific, limited tasks without sharing their main keys, keeping those keys secure.
PaymentBurn is one such task, designed to let a designated account destroy (burn) the issuer’s tokens. Both types of tokens used for stablecoins, trust line tokens and Multi-Purpose Tokens (MPTs), were at risk due to this flaw. However, documentation confirms that “Other granular permissions are unaffected.” As a result, this flaw could have allowed a partner to issue stablecoin units without the required dollar reserves, weakening the value for all holders.
The fix is included in the xrpld 3.4.0 software update, released on September 17. This package also addresses lending, automated market makers, NFTs, escrow, and other features. Ripple has significant stakes in this, as it issues Ripple USD (CRYPTO: RLUSD) on the ledger and has been promoting a lending system to banks since June.
Only Issuers Who Ignored a Warning Were Exposed
Importantly, the flaw was optional and brief. It could only have affected issuers who handed PaymentBurn to a delegate after the feature went live and did so despite existing warnings. The main danger came from a rogue partner or hacker gaining access to a delegate’s keys, undermining the assurance that proper setups mitigate key-compromise risk.
However, developers have not disclosed whether the flaw was ever exploited on the main network or how many issuers granted PaymentBurn access. Thus, the estimated value of RLUSD and other stablecoins on the ledger may not accurately reflect the risk that was ever present.
XRP holders had more reason to worry about a separate overflow bug related to a payment engine, which did affect XRP and was addressed in an update (xrpld 3.4.1), with a disclosure report published on October 9.
The Fix Vote Exposed Weak Spots in XRP Ledger Governance
Amendments to the network must receive over 80% support from validators sustained for 14 consecutive days, with any missed validation resetting the countdown. During an October 21 checkpoint, only 26 of 35 trusted validators voted in favor, falling short of the required 29 votes and delaying activation from October 23.
Since then, support has improved, with 31 out of 35 validators in favor. Public trackers don’t show which validators withdrew their support, so it’s unclear whether this was due to a technical issue or a strategic choice. Ripple had mentioned in March that it was forming an AI-assisted team to identify vulnerabilities in the ledger, but it has not disclosed who discovered this particular bug.
How Big a Risk Was the XRP Ledger Flaw, and Does the Fix Help XRP?
The risk from this flaw was confined to issuers that overlooked the warnings, and XRP balances were never at risk. The fix enhances stablecoin issuers’ confidence in using delegation, which could improve the ledger’s reputation with institutional users. However, it does not necessarily create immediate demand for XRP. Over the past month, XRP has fallen 17.9%, and it remains unclear whether this fix will reverse that trend.
A more significant test for XRP will be the deployment of Ripple’s lending system, which was 10 votes short of beginning its countdown as of October 22 and could eventually incorporate XRP into lending mechanisms. Meanwhile, if 29 or more validators maintain their support until 14:46 UTC on November 4, the fix will be implemented. If support dips below 29 at any point, the countdown will reset.
Contact [email protected] for any questions or corrections.
Sam Daodu is a crypto analyst and the editor of 24/7 Wall St.'s Crypto Desk, where he covers Bitcoin, XRP, Ethereum, Solana and the altcoins investors search for most. His work focuses on price levels, spot ETF flows, on-chain data and the regulatory decisions that move crypto markets, written so a first-time buyer and a seasoned trader can both use it.
Sam has written about crypto professionally since 2019 and has published more than 2,000 articles. Before joining 24/7 Wall St., he wrote for crypto media outlets and Web3 companies and ghostwrote for crypto founders and token launches. His analysis is syndicated on Yahoo Finance, MSN and AOL and has been cited by other crypto news sites. He also founded MacLabs Marketing, a content and personal branding agency for crypto founders and executives.
When he isn't reading charts, Sam is usually at the gym or watching One Piece, a series he maintains has better tokenomics than most altcoins.
