Updated Oct 30, 2026, 1:57 a.m. EDT Published Oct 30, 2026, 1:45 a.m. EDT
2 min read
Summary
- XRP Ledger developers have proposed four fixes to close exceptions that allow restricted tokens to reach accounts without their issuers’ approval.
- The changes would limit unapproved holders to returning tokens to the issuer unless approval is granted, but the XRP Ledger Foundation says it knows of no outsider exploiting the remaining exceptions.
- The fixes have not been merged into the network’s main software and would require support from more than 80 percent of trusted validators for two consecutive weeks before activation.
Certain assets on the XRP Ledger are meant to reside exclusively within accounts authorized by their issuer, and engineers have identified several methods that bypass this restriction.
Creators of regulated instruments, such as tokenized funds or stablecoins, can mandate authorization before anyone possesses their digital assets, frequently so they can perform identity verifications beforehand. This clearance resides on the so-called trust line, which is the connection an XRP Ledger account establishes to hold a digital currency created by a third party.
Four proposed code changes, revised this week, aim to eliminate the remaining loopholes. All four are consolidated into a single network upgrade named fixCleanup3_5_0, and none of them has been deployed on the mainnet.
One proposal would mandate clearance for both coins within a trading pool before an account can participate in it. These pools, known as automated market makers, trade assets programmatically, and a fractional stake in one constitutes a digital asset itself. Another eliminates a loophole where the verification check only triggered on trust lines possessing a zero balance, meaning a line already holding coins could continue accumulating more.
The XRP Ledger Foundation stated that programmers have been reviewing these loopholes, including how digital assets could transfer to unauthorized accounts through non-fungible token transactions prior to an August 2025 patch.
“The developer discussion is about what the protocol should guarantee, not a report of affected users,” Hussein “Vet” Zangana, director of community and product at the XRP Ledger Foundation, told CoinDesk in an email.
Any unauthorized balances present today originate from distributions executed by the issuers themselves or by accounts they previously sanctioned, according to Zangana.
The Foundation is unaware of any balance generated by an external party exploiting the existing loopholes.
What changes for holders
The patches also introduce a wider verification designed to maintain consistent authorization guidelines across existing and upcoming XRP Ledger capabilities.
That could affect anyone possessing a restricted digital asset without the creator’s permission. Under the suggestion, those tokens could only be transferred back to the issuer, although the creator could authorize the owner subsequently and restore normal functionality.
“The issuer can approve the holder’s trust line at any time, which restores full use,” Zangana said. “We know of no holder who got such a balance through a trade.”
The Foundation described the effort as standard protocol hardening, unrelated to any security breach.
None of the four modifications has been integrated into the XRP Ledger’s primary software yet. Once they are, fixCleanup3_5_0 still requires backing from upward of 80% of the network’s trusted validators for two consecutive weeks prior to activation.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
Originally published at https://www.coindesk.com/tech/2026/10/30/xrp-ledger-developers-tighten-the-rules-for-who-can-hold-restricted-tokens.
