Ripple just shipped an XRP Ledger security upgrade that closes two bugs serious enough to force a feature recall. The new release, called xrpld 3.3.0, patches the flaws and brings back the tools Ripple pulled earlier this year. Node operators are racing to install it before an August deadline. You can read the technical rundown in U.Today’s report on the upgrade.
What Went Wrong, and How Ripple Fixed It
Earlier this year, researcher Pranamya Keshkamat and the audit firm Cantina found a signature flaw in the batch transaction feature. It let an attacker fire off transactions from someone else’s account without ever touching the private keys. Ripple pulled the feature immediately.
A second bug surfaced in a permission delegation tool, disclosed back in September 2025. It let one account quietly charge fees to another account and drain its balance. Ripple pulled that feature too.
Both tools return in version 3.3.0, rebuilt with the vulnerabilities closed.
Batch Transactions and Permission Delegation Return, Safer This Time
Batch transactions let a wallet bundle up to eight actions into one atomic package. Every transaction in the batch succeeds, or all of them fail together. That protects businesses that need several steps, like a payment, a fee split, and a settlement, to land as one unit. Nothing gets left half-finished. For a small business owner running payroll on-chain, that atomicity means one failed step no longer leaves wages half-paid and hours of manual reconciliation to fix it.
Permission delegation lets a company hand a narrow, limited signing key to an employee or partner. The company keeps full control of the wallet. Nobody has to share a master key just to get work done.
A Cleanup Amendment Also Fixes AMM and Lending Bugs
The release bundles a separate fix called fixCleanup3_3_0, which resolves smaller bugs scattered across the network. It stops hybrid trading offers from vanishing off the order book when an account loses access. It also corrects faulty liquidity math in the automated market maker. That math had thrown off price estimates for traders using lending vaults and permissioned exchanges.
Ethereum’s client teams took the same approach when they shipped a coordinated patch closing five flaws in the Besu client. Fix what’s broken, ship it fast, and don’t wait for an exploit to force your hand.
As of late August, more than 60% of XRP Ledger nodes had already installed the update. The fixCleanup3_3_0 amendment sat near 69% validator support, just short of the 80% threshold it needs over two straight weeks to activate. Ripple has already voted yes.
Why the XRP Ledger Security Upgrade Matters for Adoption
Ripple has spent 2026 courting banks and asset managers for tokenized funds and cross-border settlement. None of that works if the ledger underneath has exploitable bugs. Catching these flaws before an attacker does matters. So does rebuilding the affected features instead of quietly dropping them. That’s the kind of unglamorous engineering that earns institutional trust.
Decred’s team made the same bet recently. It patched a critical flaw that could have unmasked mixed transactions before anyone exploited it in the wild. The pattern holds across chains: networks that patch fast and rebuild features safely are the ones people trust with real money.