XRP Ledger operators were urgently advised to install xrpld 3.2.1 on August 2 following a manifest flood incident on July 31 that exposed unbounded handling of unknown validator data. According to Ripple Director of Engineering Vijay Khanna, the incident prompted the release of the hotfix version, which contains four safeguards that cap manifest size, message batches, outbound sharing and unknown-key cache growth network-wide. The hotfix limits how nodes process, store and share data received from unknown validator identities, with the official xrpld 3.2.1 release dated July 31 and published as the latest signed release on August 1. Operators must complete a second restart after updating to ensure old in-memory data doesn't continue affecting operations, as the patch changes future handling while restarting clears previously retained data. The ledger continued closing normally throughout the incident, with no confirmed fund losses and no consensus failure, but unpatched nodes remain exposed to resource-exhaustion risk until operators complete the two-step upgrade process.
The revived features address critical vulnerabilities that were discovered in previous versions. Batch functionality, which reached its voting phase in February 2025, was found to have a flaw in signature validation that would have allowed attackers to execute transactions from any account without holding keys. Security researcher Pranamya Keshkamat and firm Cantina identified this vulnerability, prompting validators to reject it and emergency server releases to mark it unsupported. Permission Delegation was disclosed as vulnerable in September 2025 and disabled, with the bug allowing accounts to charge transaction fees to others and potentially drain balances. The ledger's documentation has listed both amendments as obsolete since their withdrawal, to be replaced by revised versions in the upcoming release.
The Confidential MPT amendment introduces native privacy features for Multi-Purpose Tokens on XRPL using elliptic-curve encryption and zero-knowledge proofs to conceal token balances and transfer amounts while allowing authorized verification. According to Jazzi Cooper, head of product at RippleX, this feature is designed to "balance commercial confidentiality with institutional reporting and compliance requirements." The proposal enables issuers and holders to keep transaction data private from the public while granting access to designated third parties such as auditors or regulators. This amendment is particularly relevant for US-regulated institutions evaluating public blockchains for tokenized assets, as it addresses the need for transaction confidentiality while maintaining compliance records.
The Batch amendment allows transactions involving multiple accounts to execute atomically within one ledger, with either every part of the batch succeeding or the entire operation failing. As reported by RippleX, this structure supports delivery-versus-payment functionality and reduces settlement risk in complex workflows involving several accounts or assets. The Permission Delegation feature enables account holders to grant narrowly defined transaction permissions without transferring control of signing authority, allowing institutions to authorize treasury or operations teams while keeping issuance keys under separate control. Cooper noted that this feature "removes one of the biggest onboarding hurdles: requiring every participant to acquire and manage XRP before they can interact with the network."
The Dynamic MPT amendment allows issuers to modify selected token properties after issuance, including transfer fees, metadata, and other predefined features without requiring an entirely new issuance. This feature provides limited flexibility without requiring an entirely new token creation. The activation comes as the ledger handles a growing amount of tokenized real-world assets, with XRPL adding approximately $2.6 billion in RWA value during six months through July 26, ranking second among tracked networks for net RWA inflows behind BNB Chain's roughly $3 billion. XRPL's combined distributed and represented RWA value reached approximately $4.38 billion, while stablecoins added another $995.12 million, with the wider total exceeding $5.37 billion. The network security response comes as XRPL added nearly 490,000 new accounts in the first half of 2026, pushing total accounts past 8.4 million, making robust infrastructure hardening a structural necessity for institutional adoption.
