XRP Ledger Activates Security Fix Closing Token Minting Loophole After Validator Delay

The XRP Ledger (XRPL) activated a security update on November 4, 2026, closing a vulnerability that could allow authorized token burners to create new tokens without permission. The upgrade strengthens controls over issued digital assets, including stablecoins, while leaving XRP’s native supply unaffected.

The amendment, known as fixCleanup3_4_0, became active at 14:52 UTC at ledger 108,112,129. Its activation followed a nearly two-week delay caused by a temporary decline in validator support during October.

Security Fix Prevents Unauthorized Token Creation

The vulnerability affected the XRP Ledger’s permission delegation system, which allows account owners to assign specific responsibilities to other accounts without sharing private keys.

Under certain conditions, accounts holding PaymentBurn authorization could create fungible tokens despite having permission only to destroy them. This created a potential security concern for stablecoin issuers and financial institutions using delegated account permissions.

For example, a stablecoin issuer might authorize a payment processor to burn tokens when customers redeem them for dollars. The vulnerability could potentially allow that processor to issue additional tokens without receiving separate minting authorization.

The new amendment closes this loophole by enforcing the distinction between token-burning and token-creation permissions. CoinDesk previously reported finding no public evidence that attackers had exploited the vulnerability.

Validator Support Delayed the Upgrade

The security update originally targeted October 23. However, validator support temporarily dropped to 26 of 35 trusted validators on October 21, interrupting the network’s mandatory approval period.

XRP Ledger amendments require more than 80% validator support for 14 consecutive days before activation. With 35 validators in the tracked group, the amendment needed at least 29 supporting votes.

Although support recovered approximately two hours later, the interruption restarted the approval countdown. The network subsequently secured sufficient backing, allowing the amendment to activate on November 4.

Additional Improvements Target DeFi Infrastructure

Beyond addressing unauthorized token creation, fixCleanup3_4_0 introduces corrections affecting automated market makers, asset vaults, lending calculations, and transaction processing.

The update improves rounding accuracy during vault deposits and withdrawals. It also addresses trading-pool clawback calculations and prevents certain loans from being classified as overdue before their repayment deadlines.

However, these corrections do not automatically activate the XRP Ledger’s proposed native lending infrastructure. That functionality requires separate amendments to secure sufficient validator approval.

The successful activation strengthens permission controls for businesses issuing digital assets on XRPL. It also demonstrates how the network’s validator approval process can delay upgrades when consensus temporarily weakens.