XRP Ledger (XRP) Activates Fix Closing Burn-to-Mint Loophole

By Nodora News · 5 November 2026

The XRP Ledger (XRP) activated fixCleanup3_4_0 on Nov 4, closing a loophole that let burn-only accounts mint issued tokens under some conditions.

The XRP Ledger, the blockchain behind XRP, activated a software fix on Wednesday, November 4, 2026, at 14:52 UTC that closes a loophole in how permissioned token accounts work. The amendment, called fixCleanup3_4_0, went live at ledger 108,112,129, according to XRPLWin. Under the old rules, an account authorized only to destroy (burn) an issuer's tokens could, under certain conditions, also create (mint) new ones. The flaw affected issued assets such as stablecoins on the network, not XRP itself, and no publicly confirmed exploitation has been reported.

Key takeaways

• fixCleanup3_4_0 activated Nov 4 at 14:52 UTC on ledger 108,112,129 after two uninterrupted weeks of validator support.
• It enforces the split between burn and mint permissions so a burn-only delegate cannot also create tokens.
• Issued assets on XRPL (including stablecoins) were in scope; XRP's own supply was not.
• An earlier activation attempt was reset in October when validator support briefly dipped below the 80% threshold.
• The same release also corrects vault and lending accounting, plus AMM recovery, permissioned trading and signing fixes.

What the XRP Ledger burn-to-mint loophole allowed

The XRP Ledger's permission delegation system lets one account grant another the right to perform specific actions without handing over full control. A stablecoin issuer, for example, might authorize a payment processor to burn tokens when customers redeem them for cash, while keeping minting locked to the issuer.

Under certain conditions, the older rules blurred that line. An account that held only a limited burning permission could also mint the issuer's tokens. For a fiat-backed stablecoin, unauthorized minting would mean new units appearing without matching reserves — a direct hit to the trust model issuers sell to users and regulators.

The activated fix enforces the separation between those actions. Burn remains burn; mint remains mint. CoinDesk reported the activation on November 5, citing XRPLWin for the ledger timestamp.

There have been no publicly confirmed cases of the flaw being exploited.

How fixCleanup3_4_0 cleared the validator vote

Rule changes on the XRP Ledger need support from more than 80% of the network's trusted validators for 14 consecutive days. Support is checked regularly; even a short dip below the threshold resets the countdown to zero.

Nodora covered the pending fix ahead of the Nov 4 window, when the amendment already had a clear majority. An earlier attempt in October was interrupted when support slipped — CoinDesk reported it fell to 26 of 35 validators for about two hours, less than two days before a planned Oct 23 switch-on. Once support recovered, a fresh two-week clock began. XRPLWin's amendment page shows Attempt 1 lost majority on Oct 21 after roughly 12 days, and Attempt 2 ran from Oct 21 through enablement at ledger 108,112,129 on Nov 4.

That path matters because it shows how deliberate XRPL upgrades are: no rushed flip of a switch, just sustained validator consensus before new rules become binding.

What else shipped in the same XRPL release

fixCleanup3_4_0 is a bundle, not a single-line patch. Alongside the permission fix, the release includes accounting corrections for the network's planned lending system and Single Asset Vaults — features designed so users can deposit assets into pools that can support loans. Among those changes:

• How vault deposits and withdrawals are calculated
• How loans are classified when payments become overdue
• Token recovery from automated market maker (AMM) pools
• Fixes touching permissioned trading and transaction signing

The broader lending and vault amendments still need their own validator majorities before those products can start their own activation clocks. The cleanup work landing first is meant to harden the maths before those features go live.

Why issued-asset controls matter on XRPL

XRPL's pitch to banks, payment firms and stablecoin issuers rests on precise controls: give a partner only the powers they need. A bug that turns "you may burn on redemption" into "you may also print" is exactly the failure mode a regulated issuer cannot accept.

That is why this quiet activation matters even without a known exploit. It lands while crypto platforms are under heightened security pressure — from exchange breaches to warnings such as India's CERT-In alert on AI-driven attacks against crypto exchanges — and while more real-world assets and stablecoins continue to move on-chain. Tight permissioning is table stakes for that shift.

XRP price and market context

At draft time on OKX (around 22:55 AEDT Nov 5), XRP was trading near $1.3204, up about 2.36% over 24 hours, after a session high near $1.342 and a low near $1.2765. Bitcoin (BTC) was around $80,396 (+2.29%), and Ether (ETH) around $2,422 (+3.89%). The move looks like a broad-market bounce rather than a one-coin reaction to the amendment alone.

You can track XRP against other majors on the Nodora charts page.

What to watch next

• Whether XRPL documentation and issuer guidance update now that burn/mint separation is enforced on mainnet.
• Progress of the separate lending and Single Asset Vault amendments toward the 80% / 14-day threshold.
• How major XRPL stablecoin and issued-asset operators describe their permission setups after the fix.

This article is for information only and is not financial advice.

#XRP #XRPL #Ripple #Security #Stablecoins

This article is general information, not financial advice.