XRP Ledger Fix Set for Nov. 4: The Token “Burn-to-Mint” Loophole Explained
Disclosure: Bionic Artisan may earn a commission from some links on this site, at no extra cost to you. This article contains no affiliate links.
Not financial advice: This article is for information only. It is not investment, legal or tax advice. Crypto is volatile and you can lose money. Do your own research and talk to a licensed professional before making decisions.
“XRP Ledger” is trending on Google Trends in the U.S. today (2K+ searches in the past day). The news: the network is two days away from switching on a bundle of fixes called fixCleanup3_4_0, including one for a loophole that, under certain conditions, could let an account that was only allowed to destroy a token issuer’s tokens create new ones. Here’s what the bug is, who it affects, why the fix was delayed, and what XRP holders need to do (short answer: nothing).
At a glance
- What: fixCleanup3_4_0, a bundle of small fixes shipped in XRP Ledger server software version 3.4.0 (xrpl.org release notes).
- When: earliest activation Wednesday, Nov 4, around 14:46 UTC (9:46 AM ET), if validator support holds (XRPSCAN, XRPL Dashboard). That is an earliest date, not a guarantee.
- Support: 33 of 35 trusted validators vote yes; 29 are needed (CoinDesk, XRPL Dashboard).
- Who it affects: tokens issued on the ledger, such as stablecoins. CoinDesk reports XRP’s own supply is not affected.
- For holders: no action needed for ordinary XRP holders, as far as any source we checked says.
- XRP price: about $1.25, roughly flat over 24 hours, per CoinGecko at 9:14 AM ET on Nov 2.
The bug in plain English
Besides XRP itself, the XRP Ledger lets companies issue their own tokens, such as stablecoins. Issuers can hand out limited permissions. According to CoinDesk, the flaw “can let an account authorized only to destroy an issuer’s tokens create new ones under certain conditions.”
CoinDesk’s example: a stablecoin company might let a payments partner destroy (burn) tokens when customers cash them out for dollars. That partner should need separate permission to issue new tokens. The fix enforces that separation. The official Known Amendments page describes the change as rejecting “PaymentBurn-only delegated payments” that “would cross a zero balance into a mint, unless the delegate also holds PaymentMint.”
The official documentation itself carries a warning: “Until the fixCleanup3_4_0 amendment is enabled, it is recommended not to delegate the PaymentBurn granular permission” (xrpl.org). We found no report of the loophole being exploited; treat that as unconfirmed either way.
What else is in the bundle
The burn/mint fix is one item in a long list. According to the 3.4.0 release notes and the Known Amendments page, fixCleanup3_4_0 also:
- Stops an account without a trust line from using a trading offer to receive tokens from an issuer that has blocked incoming trust lines.
- Stops an automated market maker (AMM) clawback from burning a holder’s pool (LP) tokens while recovering nothing because of rounding.
- Adds precision and rounding fixes to vault deposits and withdrawals.
- Requires a loan’s due date to have strictly passed before it can be marked late or in default.
- Adds separate signing prefixes for sponsor and counterparty signatures, so one can’t be reused as the other.
Why it was delayed by almost two weeks
XRP Ledger rule changes are called amendments. Per XRPL Dashboard, an amendment needs more than 80% of trusted validators to vote yes and keep voting yes for 14 straight days. With 35 validators on the list, that means 29 votes. If support dips even once, the two-week clock restarts.
That is what happened here. The fix was first expected on Oct 23, but support fell to 26 votes on Oct 21 and recovered about two hours later, which restarted the countdown (CoinDesk). XRPL Dashboard records the majority being lost at 8:54 AM ET and regained at 10:46 AM ET that day, putting the new projected activation at Wednesday, Nov 4, at 9:46 AM ET. Votes are counted at “flag ledgers” roughly every 16.5 minutes, so the actual switch may come a few minutes after that.
What about XRPL lending?
Some of the fixes repair lending and vault math before the lending feature itself exists on the main network. As of Nov 2, XRPL Dashboard shows the LendingProtocol amendment with 19 yes votes and SingleAssetVault with 21, both short of the 29 needed. CoinDesk notes that if both reached 29 on Wednesday, the earliest lending could go live would be Nov 18. That is a hypothetical, not a schedule.
Separately, NewsBTC reports two more open proposals about token-authorization checks that are still under developer review. They are not part of this week’s fix and are not active rules.
What this means for you
- If you just hold XRP: there is nothing to do. CoinDesk reports the bug does not affect XRP’s supply.
- If you hold a token issued on the XRP Ledger (like a stablecoin): this fix closes a permission gap at the issuer level. Watch the issuer’s official channels, not social media, for any notices.
- If you build on the XRP Ledger: read the Known Amendments entry and the 3.4.0 release notes. The release notes ask anyone running an XRP Ledger server to upgrade to 3.4.0 “as soon as possible to ensure service continuity.”
- Beware of “upgrade” scams. Network upgrades are a favorite hook for fake “migrate your tokens” messages. No holder action is required, and no one legitimate will ask for your secret key. (See our guide to keeping crypto safe on an exchange.)
More crypto news this week: why Bitcoin slipped below $77K and what to watch in November.
Our take
This is routine but meaningful maintenance. The headline bug sounds scary (“print new tokens”), but it applies to issued tokens under specific permission setups, has a fix two days from going live, and doesn’t touch XRP’s supply. The more interesting story is governance: one brief dip in validator support cost the network almost two weeks, which shows both how cautious and how slow the XRP Ledger’s upgrade process can be. Watch for Wednesday’s activation and whether the lending amendments finally gain support.
Sources: CoinDesk (Nov 2, 2026); xrpl.org Known Amendments and xrpld 3.4.0 release notes; XRPL Dashboard amendments page (checked 9:12 AM ET, Nov 2, 2026); XRPSCAN; NewsBTC (Nov 2, 2026); CoinGecko price (9:14 AM ET, Nov 2, 2026). Trending data: Google Trends U.S. “Trending now,” checked Nov 2, 2026. Times are Eastern Time (ET) unless marked UTC. Not financial advice. Images are AI-generated illustrations.
