XRP Ledger set to fix flaw that could let stablecoin partners print new tokens

XRPL lets a token issuer delegate narrow permissions to other accounts, including PaymentBurn, which is meant only to let a partner destroy tokens on the issuer's behalf. That delegation path sat untouched even as stablecoin issuance on XRPL grew, with Ripple's own RLUSD and other trust-line and MPT-based assets relying on the same permission system. The flaw meant a burn-only delegate could, under specific conditions, mint instead of destroy.

Issuers who had granted PaymentBurn authority to custodians, exchanges or other partners no longer need to treat that grant as a latent minting right; the delegate's power is now confined to destruction, matching what issuers thought they had approved. Stablecoin issuers and anyone running trust-line or MPT-based assets on XRPL should re-check which accounts hold burn delegation and update internal risk assessments, since the prior configuration could have let a trusted third party expand supply without the issuer's separate PaymentMint approval.

A permission meant to narrow an account's power instead widened it, which is the quieter risk in delegated systems: convenience features on a ledger marketed for institutional asset issuance can carry side effects that only surface in documentation or audits years later. XRP itself was never exposed, but the episode tests how much trust stablecoin issuers should place in a shared ledger's permission model rather than their own custody logic, a question RWA and stablecoin projects on XRPL will keep weighing.

The fix activated on November 4 at 14:52 UTC in ledger 108,112,129, after validator backing recovered from a drop below the roughly 80% threshold on October 21 to 33 of 35 trusted validators. No exploit has been confirmed, so the open question is whether issuers or XRPL developers publish a review of historical PaymentBurn activity to rule out quiet misuse before the amendment closed the gap.

XRPXRP it is the asset of the company or protocol in the event

XRP barely moved in the 4 hours after the first headline, after a flat 2 hours before.

48 prices, one every 30 minutes