In the latest XRP update, the XRP Ledger released the xrpld 3.2.1 hotfix on July 31 after a validator manifest flood was identified impacting network nodes. Ripple Director of Engineering Vijay Khanna issued an urgent recommendation on Aug. 1–2, asking all XRPL node operators to upgrade immediately.
The network continued operating normally throughout the event, with no reported loss of user funds and no interruption to consensus. However, operators running older versions remain exposed to potential resource exhaustion issues until they complete the required two-step upgrade procedure.
The announcement came as XRP declined 1.5% over 24 hours, slipping from $1.10 to $1.06, while daily trading volume reached approximately $791 million. The move added to recent market weakness, with XRP down nearly 4% over the past seven days.
How the XRPL Manifest Flood Attack Worked
The incident targeted a weakness in the way XRPL nodes processed validator manifests. Before the patch, nodes could accept, store, and propagate unlimited validator manifests associated with unknown keys, with no restrictions on the amount of data being handled.
By generating large quantities of unnecessary manifest data, an attacker could force affected nodes to consume excessive memory, storage, and bandwidth resources while processing information that had no practical value.
The exploit was classified as a resource exhaustion or denial-of-service attack rather than a consensus-level threat. Although node infrastructure could be strained, the ledger’s transaction processing and agreement mechanisms remained unaffected.
XRPL developers confirmed that the issue involved validator manifest handling within XRPLF nodes. However, the full technical explanation, including the attacker’s exact method and the scale of exploitation, has not yet been publicly released.
XRPL Operations is expected to publish a detailed analysis covering attack patterns, traffic volumes, and additional security measures implemented after the event.
The incident reflects a broader blockchain security concern: systems that support consensus, even if they do not control consensus directly, can become targets when their data handling processes lack proper limits.
xrpld 3.2.1 Introduces Four Key Protections
The xrpld 3.2.1 update adds four separate safeguards aimed at preventing similar manifest flooding attacks.
The patch now rejects oversized manifests before they can be fully decoded, limits the number of manifests accepted within each network message, reduces the amount of manifest information distributed to new peers, and restricts the unknown-validator manifest cache to a maximum of 100 entries.
The update also changes how unknown validator manifests are handled by preventing them from being saved to disk. As a result, any malicious data collected before the upgrade will be removed after a restart instead of remaining stored on the system.
Because of this storage change, node operators must complete a two-step upgrade process.
Operators should first install xrpld 3.2.1 and allow the server to operate for one to two minutes. Afterward, they must restart the server again to clear any outdated manifest data that existed before the patch was applied.
Skipping the second restart may leave previously accumulated flood data in place and prevent the full fix from taking effect.
Operators are also advised to confirm that their systems recognize Ripple’s latest GPG signing key, which was updated on Feb. 18, 2026. If the correct key is not installed, automated upgrades may fail without providing a clear notification.
