The XRP Ledger (XRPL) activated a security upgrade on November 4, 2026, closing a flaw that could have allowed accounts authorized only to burn tokens to mint new ones without permission. The amendment reinforces controls over issued digital assets, including stablecoins, and leaves XRP's native supply untouched.

Known as fixCleanup3_4_0, the change took effect at 14:52 UTC on ledger 108,112,129. Activation came nearly two weeks later than planned after validator support temporarily slipped during October.

Closing the Unauthorized Token Creation Loophole

The flaw sat within the ledger's permission delegation system, a feature that lets account owners hand specific duties to other accounts without sharing private keys. Under certain conditions, an account holding PaymentBurn authorization could create fungible tokens even though its mandate was limited to destroying them.

The exposure carried particular weight for stablecoin issuers and financial institutions that rely on delegated account permissions. A stablecoin issuer, for instance, might grant a payment processor authority to burn tokens when customers redeem them for dollars. The vulnerability could have enabled that same processor to issue additional tokens without receiving separate minting approval — tokens that would have entered circulation without matching reserves behind them.

fixCleanup3_4_0 eliminates the loophole by strictly separating token-burning rights from token-creation rights. CoinDesk previously reported finding no public evidence that attackers had exploited the weakness.

Validator Support Slipped Before Activation

The update was originally scheduled for October 23. On October 21, however, backing fell to 26 of 35 trusted validators, interrupting the network's mandatory approval window. XRPL amendments must hold more than 80% validator support for 14 consecutive days before going live — with 35 validators in the tracked group, at least 29 supporting votes were required.

Support recovered roughly two hours later, but the interruption restarted the approval countdown. The network subsequently secured sufficient backing, and because the 14-day window counts only continuous support, November 4 marked the earliest date the requirement could be met again — the day the amendment went live.

Additional Corrections Target DeFi Infrastructure

Beyond the permission fix, fixCleanup3_4_0 introduces corrections affecting automated market makers, asset vaults, lending calculations, and transaction processing. Rounding accuracy during vault deposits and withdrawals improves, trading-pool clawback calculations are addressed, and certain loans will no longer be classified as overdue ahead of their repayment deadlines.

These corrections do not automatically activate the XRP Ledger's proposed native lending infrastructure; that functionality depends on separate amendments securing sufficient validator approval. Whether those proposals can hold supermajority backing across the same 14-day window will determine when native lending reaches the ledger.

The successful activation tightens permission controls for businesses issuing digital assets on XRPL and illustrates how the network's validator approval process can hold up upgrades when consensus temporarily weakens.