XRP Ledger flaw: what it teaches about stablecoin issuer risk
XRP Ledger will patch a flaw on Nov 4 that let burn-only accounts mint tokens. What happened and what it means for everyday stablecoin users.
This week, the XRP Ledger community is getting ready to activate a patch that speaks directly to stablecoin issuer risk. According to CoinDesk, a flaw let an account authorized only to burn tokens, under certain conditions, create new ones. No exploitation has been reported, but the episode highlights something most people never check when they hold digital dollars.
What actually happened
On XRP Ledger, an issuer can give a third party (say, a stablecoin company’s payment provider) permission to burn tokens, meaning to take them out of circulation. That permission is supposed to be destruction-only. The flaw broke that separation: under certain conditions, a burn-only account could issue new tokens.
The fix, called fixCleanup3_4_0, is expected to activate on November 4, 2026, around 14:46 UTC. According to a summary from Bitcoinhaber, it needs 29 of 35 trusted validators and already has 33. Native XRP is unaffected; the problem touches issued tokens, including stablecoins.
Why it matters even if you never use XRP Ledger
Vexo Wallet isn’t built around this network, and this story is not a reason to move your funds anywhere. It matters for the lesson underneath: a stablecoin is not just an entry on a blockchain. It is an issuer’s promise, backed by reserves and by technical permissions you can’t see from your app.
When you hold USDT or USDC, you rely on several layers at once:
- Reserves: that each token has a dollar (or equivalent) behind it.
- Issuer permissions: who can mint, burn or freeze tokens, and under what controls.
- Network code: that the blockchain does what its documentation says.
This episode shows the third layer can fail too, and that delegated permissions (the “third party that can burn”) are a sensitive spot. For everyday users, the good news is that it was caught and is being fixed by validator consensus with no known losses.
What changes for stablecoin users
Little day to day, but it helps to be clear about which risks you control and which you don’t:
- What you control: custody. With a non-custodial wallet the keys are yours. No bankrupt exchange or careless employee can move your tokens.
- What you don’t control: the issuer. No wallet can stop an issuer from freezing funds or a network bug from affecting a token. We saw it recently when Tether froze USDT after the Binance hack.
- What you can reduce: concentration. Spreading across issuers and networks limits the damage if one fails. If you’re torn between the two big ones, read USDT vs USDC.
How this connects to self-custody
Self-custody doesn’t mean “zero risk”. It means you remove the risk of a third party holding your funds and take on responsibility for your seed phrase. Issuer and network risks remain, and it’s honest to say so. Vexo Wallet works with no account and no KYC, with gasless USDT on TRON, USDC on Polygon and stablecoins on Solana, but none of those features replaces choosing your assets and issuers carefully.
What to watch in the coming days
- Whether the November 4 activation completes without incident.
- Whether issuers of stablecoins on that network publish an impact analysis.
- Whether other networks review how they delegate burn and issuance permissions.
Meanwhile the practical advice stays the same: keep your seed phrase offline, don’t put everything with a single issuer, and be wary of anyone promising zero risk.
Frequently asked questions
Did anyone lose money because of the XRP Ledger flaw?
According to the sources consulted, there is no evidence the flaw was exploited. The fix is being activated preventively on November 4, 2026.
Does it affect my USDT or USDC?
The story concerns tokens issued on XRP Ledger. USDT on TRON or USDC on Polygon or Solana run on different networks and aren’t affected by this specific flaw.
What is stablecoin issuer risk?
It is the possibility that the issuer fails, freezes funds, lacks enough reserves or makes a technical mistake in the permissions it controls. A non-custodial wallet doesn’t remove that risk; it only removes custody risk.
Does having my own wallet protect me from these problems?
It protects you from a third party losing or locking your keys, but not from issuer or network failures. That’s why diversifying and keeping good seed phrase habits both matter.