XRP Ledger has activated a fix for a bug that could allow accounts authorized to destroy issued tokens to create new ones under certain conditions. Cointelegraph reported the activation on November 5. The network's developer documentation describes the affected permission, PaymentBurn, and had advised against delegating it until the correction became active.
The amendment, fixCleanup3_4_0, closes a gap between the authority an issuer intended to grant and the transactions a delegate could execute. The reported vulnerability concerns issued assets, including trust-line tokens and Multi-Purpose Tokens.
A burn permission crossed into token creation
Permission delegation lets an account authorize another account to perform selected operations on its behalf. An issuer can therefore assign an operational task without giving the service account full control.
The flaw sat inside that division of authority. XRP Ledger's permission reference separates PaymentMint, which permits token creation, from PaymentBurn, which permits token destruction. Before the correction, an account granted the latter could also mint fungible tokens in certain circumstances. The documentation says other granular permissions are unaffected.
For an issuer, that breaks the expected boundary around supply management. A service account intended to reduce outstanding balances should have no route to increasing them through the same permission.
The repair addresses a specific transaction condition. The xrpld 3.4.0 release notes say the amendment rejects PaymentBurn payments that cross a zero balance. Transactions using the burn permission must therefore respect that balance boundary.
The activation report describes a security repair. The announcement does not confirm exploitation or substantiate the stronger claim that developers conclusively prevented every attempted exploit. Nor are the other corrections bundled into the amendment evidence that each affected component suffered an attack.
Activation followed an interrupted countdown
XRPLWin's ledger-based amendment tracker records activation at 14:52 UTC on November 4, 2026, at ledger 108,112,129. Cointelegraph's November 5 update therefore reports a change already active on the network.
The tracker's history shows an earlier attempt lost its qualifying majority after a window running from October 9 to October 21. A second window began on October 21 and ended with activation on November 4.
That sequence separates the availability of repair code from the point when the corresponding ledger rules take effect. The fix was included in xrpld 3.4.0, but the permission warning was explicitly conditional on amendment activation.
For operators, installing software containing an amendment and having the network enable it are separate milestones. Both matter when determining which rules a transaction will encounter.
The news goes beyond a routine software release: the activation process for a disclosed permission flaw is now complete. Readers following the separate mitigation work involving Solana validators will recognize the operational importance of identifying the exact condition that makes a repair effective.
Issuers retain responsibility for delegated access
XRP Ledger's delegation documentation describes a practical reason for splitting authority: frequently used keys may need to remain on internet-connected servers, while keys with full account control can stay offline. Restricting the online account's permissions limits the work it can perform.
A defect in those restrictions weakens that arrangement even when the issuer retains its main keys. The PaymentBurn bug illustrates why the security benefit depends on the operations the protocol actually permits.
Account owners grant permissions through a DelegateSet transaction. They can change or revoke those permissions with another transaction of the same type. Delegates can receive up to 10 permissions, and some powers, including operations that change cryptographic keys or grant further permissions, cannot be delegated.
The practical response for issuers is to review which accounts hold operational authority and whether each grant still matches its assigned task. Activation repairs the disclosed transaction path; permission management remains an issuer decision.
The same cleanup amendment contains other corrections. Release notes describe changes to automated trading pool clawbacks, escrow reserve handling and signature separation. One signing change gives counterparty and sponsor signatures distinct prefixes, preventing a signature created for one role from being reused as the other.
Those repairs address different transaction rules. The separate BTCPay hot-wallet shutdown reports concern a different security problem, with different operational consequences.
Overview
XRP Ledger has enabled fixCleanup3_4_0, closing a disclosed path through which delegated token-burning authority could permit unauthorized token creation. The repair rejects PaymentBurn transactions that cross a zero balance. XRPLWin records the amendment as active from November 4, 2026, at ledger 108,112,129.
