XRP Ledger: The bug that allowed tokens to be created instead of destroying them is fixed

Destroying tokens should not allow them to be created. The XRP Ledger activated a patch on November 4, 2026 at 2:52 p.m. UTC that restores this separation to its permission delegation system. The amendment fixCleanup3_4_0 entered into force at register number 108 112 129, according to in-house data.

The flaw affected certain tokens issued on the network, not the native asset XRP. No cases of exploitation have been publicly confirmed at this stage.

Key Points

Permission limited to the destruction of tokens could also allow their creation in certain circumstances.

The issue affected Classic Tokens and Multi-Purpose Tokens, not just MPTs.

Activation required two consecutive weeks of support above 80% of trusted validators.

A first voting period failed in October; the deadline is not counted in nine months.

XRP Ledger fixes faulty separation between creation and destruction

Delegation allows an account to authorize another account to perform certain operations for it, without transmitting its private keys or giving it full rights.

A stablecoin issuer can, for example, entrust a service provider with the destruction of tokens when customers request their reimbursement. This service provider must not, however, be able to issue new units.

However, before the patch, the PaymentBurn permission could allow tokens to be created in certain circumstances. The official documentation specifies that the defect affected both tokens using trust lines and Multi-Purpose Tokens (MPT). It recommended not delegating this permission before activating the patch. Other permissions were not affected.

The risk therefore related to an unauthorized issuance of third-party assets. For a stablecoin, such an operation could create a gap between units in circulation and corresponding reserves. However, this is a possible consequence, not a harm established in this case.

Two weeks of voting before patch activation

Changes to transaction processing on XRP Ledger go through a system of amendments. To take effect, they must have more than 80% support for two weeks, as voted by trusted validators. A loss of this majority interrupts the count.

A first activation attempt failed in October after a decline in support from validators. The countdown then started again from zero. The fix finally went into effect on November 4, after two consecutive weeks above the required threshold.

The amendment also includes fixes to custodial vaults, the lending system, trading pools and transaction signatures. Server operators must use a version compatible with the activated rules to ensure the continuity of their service.