Ripple CTO: XRPL node stability restored after spam attack, latency drops to 165 ms

XRPL recovers after July infrastructure crisis

The latest telemetry, which spans August 25 to September 8, comes roughly a month after an infrastructure crisis rocked the XRP Ledger. On July 31, anonymous actors targeted the network with a “manifest storm”—an attack that flooded the system with thousands of fake validator credentials.

A manifest acts as a digital credential for each validator node. By overwhelming the network with inauthentic manifests, attackers forced legitimate nodes to divert resources toward processing spam, putting the ledger’s operational stability at risk.

Schwartz’s core relay hub was among the most affected servers. It experienced numerous connection failures, including an “onReadMessage” error right at the agreement stage, the critical moment when nodes compare and validate the state of the ledger. Despite the widespread disruption, block finalization and consensus mechanisms continued without interruption, and network engineers intervened swiftly to resolve the problem without taking the network offline.

Security upgrades and real-world performance

XRP Ledger developers quickly released the xrpld 3.2.1 hotfix after the incident. The update curtailed the potential impact of spam by capping the size of manifests and improving how the system caches data from unknown nodes. This change aimed to prevent the network from wasting computing power on unauthenticated entities.

Schwartz reviewed the impact of these security measures in his latest publication, revealing that the system’s stability has not only recovered but also strengthened against similar attacks. New monitoring data shows that his relay hub reliably supports around 400 simultaneous connections, reaching a peak of 423 in this period—comprising 135 inbound and 271 outbound links with other network nodes.

Latency, a core indicator of network health reflecting the response time between nodes, dropped to 165 milliseconds. This improvement highlights the recovery from the prior disruption. The only irregularity spotted was a brief latency spike to 1.49 seconds on September 6, which the system’s algorithms managed without any impact on ledger consensus.

The updated XRPL node software effectively contained threats and maintained both connectivity and consensus, eliminating nearly all malicious traffic while keeping connection interruptions within normal operational ranges.

Metrics for malicious behavior, labeled as “Abuse,” have almost vanished, as the enhanced filters now block the vast majority of suspicious activity. The network’s rate of dropped connections registered at 84.6 incidents per five minutes, within typical limits for XRPL hubs under heavy load.

Wider trends: Web3 infrastructure and tokenized assets

These technical improvements and resilient performance come at a time when traditional financial infrastructure is facing a paradigm shift. Industry participants are turning to Web3 solutions, with platforms such as 1stepSwap enabling investors to directly hold shares of leading U.S. companies, gold, and silver in crypto wallets. Tokenization of real-world assets—and automatic optimization for best prices across markets—removes intermediaries, streamlining market access for users accustomed to complex traditional brokerage systems.

Schwartz’s findings serve as a public demonstration that the XRP Ledger and its core hubs are ready for ongoing, stable network activity, even as market participants increasingly explore on-chain infrastructure and asset tokenization.

Network data confirms the latest software update has prepared XRPL for stable, high-volume operation, building resilience for the ecosystem’s next phase of growth.