The XRP Ledger's core software, xrpld, received an emergency hotfix over the weekend after an attacker exploited how the network handles validator manifests. The denial-of-service attack flooded nodes with oversized or invalid manifests, draining system resources but never halting transaction processing or causing fund losses. Ripple's director of engineering, Vijay Khanna, issued an urgent call for all node operators to upgrade to version 3.2.1 immediately on August 1-2.
How the attack worked
The exploit targeted the way the XRP Ledger accepts, caches, and rebroadcasts validator manifests — the messages validators use to announce their identity and configuration. Normally, the network trusts these messages and shares them freely. The attacker sent a flood of manifests, many oversized or from unknown validators, overwhelming nodes' memory and CPU. The ledger itself kept closing normally, and no consensus failure occurred, but unpatched nodes risked resource exhaustion that could knock them offline.
Four safeguards in the hotfix
Version 3.2.1 introduces four specific protections. First, nodes now reject any manifest that exceeds a size limit. Second, incoming batches of manifests are capped to prevent a single burst from saturating the node. Third, the amount of manifest data shared with new peers is limited, reducing the spread of malicious traffic. Fourth, the cache for manifests from unknown validators is hard-capped at 100 entries. Additionally, unknown-validator manifests are no longer written to disk, preventing persistent storage bloat. The upgrade requires a two-step process: install 3.2.1, run for one to two minutes, then restart to purge any stale data already cached.
Who needs to upgrade
Any business running its own XRPL server — exchanges, custodians, wallet backends, data providers — must complete the upgrade. Unpatched nodes remain exposed to the resource-drain risk. The previous version, 3.2.0 released June 15, spread faster among validators than the broader node network, meaning some operators may still be on older versions and are now doubly exposed. Operators should also verify their systems trust Ripple's current GPG signing key, which was rotated on February 18, 2026; automatic upgrades may fail silently if the key is outdated.
No action needed for ordinary holders
Regular XRP holders do not need to move funds or change keys. The attack did not compromise user wallets or the ledger's transaction history. XRP's price dipped 1.5% in 24 hours, from $1.10 to $1.06, with daily trading volume of $791 million, and was down 4% over seven days. The price movement appears tied to the attack news and broader market conditions.
XRPL Operations plans to release a technical post-mortem that will clarify attacker behavior, traffic volumes, and additional hardening steps. Until then, node operators who haven't upgraded should treat the hotfix as urgent. The incident underscores the scaling challenges the XRP Ledger faces as its network grows — it recently added nearly 4 million new accounts. The question now is how quickly the remaining unpatched nodes will apply the fix before another wave of malicious manifests arrives.
