The XRP Ledger is approaching a second deadline to activate a security fix designed to close a token-minting loophole with potential implications for stablecoin security on the network. The amendment, known as fixCleanup3_4_0, is projected to activate on November 4, following an earlier delay caused by falling validator support.

Nothing fancy here but happy this fixCleanup amendment is going live on the XRP Ledger in the next 48h! Hardening and improving the XRP protocol. pic.twitter.com/XAzbFW4rPY

— Vet (@Vet_X0), November 2, 2026

The amendment currently holds the backing of 33 of the ledger's 35 trusted validators, comfortably exceeding the threshold required to sustain activation. Support, however, must remain at that level continuously for 14 days, and a renewed drop below the threshold could push the deadline back once more. The live vote tally is publicly trackable on the amendment's XRPSCAN page, giving issuers and developers a direct view of whether the countdown holds.

The fix is particularly relevant to stablecoin security because it addresses the permissions used to destroy issued tokens. Under certain conditions, an account authorized only to burn tokens—an account tasked solely with removing tokens from circulation—could also create new ones, expanding supply without permission.

Second Activation Deadline

The amendment initially targeted October 23 as its activation date, but validator support briefly fell to 26 of 35 on October 21. That figure was below the 29 votes required to maintain the approval threshold, resetting the two-week activation countdown.

Support recovered to the required level later that day, restarting the clock and moving the earliest activation date to November 4. The amendment now has 33 supporting validators, a four-vote cushion above the minimum—the equivalent of at least 29 votes under the ledger's 80% rule.

XRP LEDGER BIG UPDATE XRPL bug fix is delayed until November 4. It closes a loophole that could let burn only accounts create new tokens. Will this delay affect confidence in $XRP, even as ETFs have attracted $1.8 billion in net inflows since launch? pic.twitter.com/hgzHkyQvXV

— TMA | The Money Ape (@TheMoneyApe), October 22, 2026

Under the XRP Ledger's amendment process, protocol-level changes must maintain support from more than 80% of trusted validators for 14 consecutive days before they can activate. Trusted validators are the server operators that drive the ledger's consensus, so their individual support decisions directly determine when protocol upgrades go live. The network checks support at regular intervals, meaning even a temporary dip can restart the countdown. Amendments do not expire when support lapses; a change simply waits until enough validators back it for the full two-week window.

The current activation estimate is November 4 at 14:46 UTC, based on the support clock restarted on October 21. The date remains conditional until the amendment is formally enabled on the network.

Why the Fix Matters for Stablecoin Security

The vulnerability involves XRPL's delegated PaymentBurn permission, which allows an account to destroy fungible tokens or Multi-Purpose Tokens on behalf of an issuer. Delegated permissions let issuers hand specific token operations, such as burning, to external accounts or service providers. In certain circumstances, the same permission could also allow a delegate to mint new tokens despite lacking authorization to create them. The amendment is designed to enforce a clearer separation between token burning and issuance.

Unlike XRP itself, all other tokens on the ledger are issued assets, tied to issuing accounts through trust lines that determine who may hold and transfer them. This matters for stablecoins because issuers may rely on third-party services to burn tokens when customers redeem them for fiat currency, and those services should not be able to create additional tokens without the issuer's authorization. Unauthorized issuance could undermine confidence in a token's supply controls, particularly for assets engineered to maintain a fixed value against reserves.

XRPL's official documentation warns developers against delegating PaymentBurn until the fix activates. That caution is tied to the activation timeline, so any further slip past November 4 would extend the period during which the documentation's warning remains in effect.

Ripple's RLUSD, a US dollar-backed stablecoin, operates on both the XRP Ledger and Ethereum, making XRPL's token controls relevant to the network's stablecoin ecosystem. There is, however, no public evidence that RLUSD was affected by the flaw or that its reserves were compromised.

The amendment forms part of a broader package of technical fixes covering token permissions, automated market makers, vaults, lending calculations, escrow, and other ledger functions. It does not on its own activate XRPL's proposed lending protocol, which remains a separate proposal requiring its own validator approval.

If the amendment activates on schedule, it will close the permission loophole and strengthen safeguards around issued assets on the ledger. Another dip in validator support, though, could delay the upgrade once again and leave the network waiting for its next activation window.